A controller marks processing as restricted after a data-subject request but continues using the same personal data for marketing campaigns. What does restriction require operationally?
Select an answer to reveal the explanation.
Short Explanation
Restriction means park it—not keep driving it through the marketing lane. Once restricted, the data mostly sits in storage aside from a short list of allowed uses. Running ads on restricted records misses the point of the right.
Full Explanation
Article 18 restriction limits processing so that, aside from storage, the data are processed only with the data subject’s consent or for limited purposes such as legal claims, protecting another natural or legal person’s rights, or important public interest. Continuing ordinary marketing on restricted personal data conflicts with those operational limits.