# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 18** — Right to restriction of processing
- **Article 19** — Notification obligation regarding rectification or erasure of personal data or restriction of processing
- **Article 21** — Right to object (triggers restriction under Art. 18(1)(d) pending assessment)
- **Article 12** — Transparent communication and modalities for exercise of rights
- **Recital 67** — Methods of restriction: moving selected data to another processing system, making data unavailable to users, or temporarily removing published data

### UK Data Protection Act 2018
- **Section 18** — Supplementary provisions for the right to restriction of processing under UK GDPR

## Regulatory Guidance

### European Data Protection Board (EDPB)
- **Guidelines 01/2022 on data subject rights — Right of access** (adopted 28 March 2023): Addresses the interaction between restriction requests and the right of access, clarifying that restricted data must still be accessible to the data subject under Art. 15.
- **Guidelines on Transparency under Regulation 2016/679 (WP260 rev.01)** (adopted 11 April 2018): Guidance on communicating restriction decisions and lifting notifications in a transparent manner.

### Information Commissioner's Office (ICO) — United Kingdom
- **Right to restrict processing guidance** (updated 2024): Practical guidance on implementing restriction, including technical measures and the obligation to notify before lifting.

## Technical Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 7.4.4** — Restriction of processing: establishes controls for implementing and managing processing restrictions within a PIMS.

### ISO/IEC 27001:2022 — Information Security Management
- **Annex A Control 5.12** — Classification of information: supports the implementation of data flagging mechanisms for restricted data.
- **Annex A Control 8.3** — Information access restriction: provides the access control framework for isolating restricted data.