Template Letter to Restrict Processing

Summary

This is a template letter published by the Jersey Office of the Information Commissioner (JOIC) to help individuals exercise their right under Article 33 of the Data Protection (Jersey) Law 2018 to request that an organisation restrict the processing of their personal data. It is a form/tool rather than binding guidance, but it sets out the statutory grounds and response obligations that organisations receiving such a request must follow.

• Grounds for restriction: The template lets the individual select one or more statutory grounds: contesting accuracy pending verification, opposing erasure of unlawfully processed data and requesting restriction instead, retention needed by the individual for legal claims after the controller no longer needs the data, or restriction pending verification of an objection to processing under Articles 35/36/37.
• Organisation's response: The letter asks the organisation to confirm in writing that the restriction has been applied, or to explain its reasons if the request is refused, and to confirm receipt of the letter.
• Identity verification: The organisation may request proof of identity, which the individual asks to be told about promptly.
• Response timeframe: The letter states that under the Data Protection (Jersey) Law 2018 the organisation must respond without undue delay and, in any event, within four weeks of receipt, and should explain any delay and give an anticipated timescale if it cannot meet this period.

Compliance officers and DPOs should use this template to understand what a valid restriction-of-processing request looks like and what statutory response obligations apply once such a request is received.

Key obligations

• An organisation receiving a restriction of processing request under Article 33 DPJL 2018 must respond without undue delay and, in any event, within four weeks of receipt
• If the organisation cannot comply within four weeks, it must inform the requester of the anticipated timescale and the reasons for the delay
• The organisation must confirm in writing that the requested restriction of processing has been applied, or explain its reasons if the request is refused in whole or in part

Applies to

data controllers, organisations processing personal data

Deadlines

• within four (4) weeks of receipt: Statutory deadline for an organisation to respond to a request to restrict processing under Article 33 of the Data Protection (Jersey) Law 2018