Requirement
Data subjects may obtain restriction of processing while accuracy is contested, where processing is unlawful but erasure is opposed, where the controller no longer needs the data but the data subject needs it for legal claims, or pending verification of an objection; restricted data may then only be stored, and the data subject must be told before a restriction is lifted.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| CCPA/CPRA | 1798.110 & 1798.115 | Right to know and access | data-subject-rights |
| CCPA/CPRA | 1798.125 | Non-discrimination and financial incentives | data-subject-rights |
| CCPA/CPRA | 1798.130(a)(1)-(2) | Methods for requests and 45-day response | data-subject-rights |
| CCPA/CPRA | Regs (ADMT) | Automated decision-making technology for significant decisions | data-subject-rights |
| NDPA 2023 | s.34(1)(a)-(c) | Right of access and rectification | data-subject-rights |
| NDPA 2023 | s.38 | Right to data portability | data-subject-rights |
| NDPA 2023 | s.36-37 | Objection and automated decision-making | data-subject-rights |
| CCPA/CPRA | 1798.105 | Right to delete | data-subject-rights |