Source: OJ L 119, 4.5.2016, pp. 1–88Consolidated text

Current language: EN

Article 23 Restrictions

Summary What does Article 23 of the GDPR regulation say?

This article establishes the conditions under which Union or Member State law can legitimately restrict the data protection rights and obligations set out elsewhere in the GDPR — most notably those in Articles 5 and 12 to 22, which cover core data protection principles and data subject rights.

It acts as a controlled exception to those provisions, permitting restrictions only where necessary to safeguard a defined set of public interests, ranging from national security and defence to the enforcement of civil law claims.

The article also sets out the minimum content requirements that any such legislative restriction must contain, ensuring that even where rights are curtailed, a structured framework governs how that curtailment is applied.

Important points:

  • Union or Member State law may restrict core data subject rights and controller obligations, but only through a legislative measure and only to safeguard one of the explicitly listed public interests.
  • Any legislative measure introducing such a restriction must include specific provisions covering elements such as the purpose of processing, categories of data, scope of the restriction, safeguards against abuse, and storage periods.
  • Data subjects retain a right to be informed about any restriction imposed, unless informing them would be prejudicial to the purpose of the restriction itself.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

      1. national security;

      2. defence;

      3. public security;

      4. the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

      5. other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;

      6. the protection of judicial independence and judicial proceedings;

      7. the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

      8. a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

      9. the protection of the data subject or the rights and freedoms of others;

      10. the enforcement of civil law claims.

    1. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

      1. the purposes of the processing or categories of processing;

      2. the categories of personal data;

      3. the scope of the restrictions introduced;

      4. the safeguards to prevent abuse or unlawful access or transfer;

      5. the specification of the controller or categories of controllers;

      6. the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

      7. the risks to the rights and freedoms of data subjects; and

      8. the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

Table of contents

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Contact us:

springlex@springflod.se

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod