A controller marks processing as restricted after a data-subject request but continues using the same personal data for marketing campaigns. What does restriction require operationally?
Select an answer to reveal the explanation.
Short Explanation
Restriction means park it—not keep driving it through the marketing lane. Once restricted, the data mostly sits in storage aside from a short list of allowed uses. Running ads on restricted records misses the point of the right.
Full Explanation
Restriction of processing is an operational state, not a cosmetic CRM label. After marking processing as restricted following a data-subject request, the controller should generally limit use to storage and narrow permitted purposes—such as establishing legal claims or protecting another person’s rights—not continue business-as-usual marketing campaigns with the same personal data. If campaigns still select the record, restriction has failed in substance.
Restriction is not only a label that never changes permitted uses. Restriction does not always mean permanent deletion within forty-eight hours; erasure is a different right with different effects. Marketing is not expressly exempted from the effects of restriction; continuing promotions on restricted data contradicts the pause the person requested.
Exam caveat: if marketing still runs on “restricted” records, restriction has failed in practice—an easy exam trap. Operational check: technical flags that block campaign selection, suppressions across channels and processors, audits that restricted records are excluded, and staff training on permitted narrow uses. City and public CRM systems should prove that a resident’s pause request actually stops promotional use—otherwise civic promises about control ring hollow.