Users can request restriction of processing while disputes are resolved

GDPR Art. 18 grants users the right to request restriction of processing in four specific circumstances: contested accuracy, unlawful processing they oppose erasing, data needed for legal claims, or pending objection under Art. 21. This right is rarely exercised but must be possible to honor. An application with no restriction mechanism and no documented process cannot respond to an Art. 18 request within the legally required one-month window. Crucially, a restriction flag must actually prevent the data from being used in analytics exports, marketing sends, and third-party pipelines — a flag that exists in the database but is never checked in application code is not compliance.

Add a processingRestricted boolean to your users table and expose a self-service restriction endpoint. Honor the flag everywhere personal data is used outside direct service delivery.

// app/api/user/restrict/route.ts
export async function POST() {
  const session = await getServerSession()
  if (!session?.user?.id) return new Response('Unauthorized', { status: 401 })
  await db.user.update({
    where: { id: session.user.id },
    data: { processingRestricted: true, restrictionRequestedAt: new Date() }
  })
  await notifyPrivacyTeam({ userId: session.user.id, type: 'restriction_request' })
  return Response.json({ ok: true })
}

Check processingRestricted before including users in analytics exports, marketing sends, or third-party data shares. Add the right to your privacy policy: "You have the right to request restriction of processing under Art. 18 GDPR. Contact privacy@example.com."