Art. 23 GDPR · Chapter III: Rights of the data subject · Section 5: Restrictions
Article 23 GDPR: Restrictions
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Union or Member State law may restrict the scope of certain obligations and rights in the Regulation when the restriction respects the essence of fundamental rights and is a necessary and proportionate measure to safeguard one of the interests listed, such as national security or the prevention of crime. Such laws must contain the specific provisions listed in paragraph 2.
Official text
Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
national security;
defence;
public security;
the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;
the protection of judicial independence and judicial proceedings;
the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
the protection of the data subject or the rights and freedoms of others;
the enforcement of civil law claims.
In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:
the purposes of the processing or categories of processing;
the categories of personal data;
the scope of the restrictions introduced;
the safeguards to prevent abuse or unlawful access or transfer;
the specification of the controller or categories of controllers;
the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
the risks to the rights and freedoms of data subjects; and
the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-307/22, FT v DW
Judgment of 26 October 2023ECLI:EU:C:2023:811
The first copy of one's data must be free even if the request has no data protection motive; national law cannot make patients pay for it; a patient is entitled to a full copy of medical records where needed to check accuracy.
- C-175/20, SIA 'SS' v Valsts ieņēmumu dienests
Judgment of 24 February 2022ECLI:EU:C:2022:124
A tax authority that collects large amounts of personal data from a business must respect the principles in Art. 5(1); it may only derogate from them on the basis of a legislative measure under Art. 23(1).
Related (earlier law or other instruments)
- C-597/19, Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA
Judgment of 17 June 2021ECLI:EU:C:2021:492
Instrument: GDPR together with the IP Enforcement and ePrivacy Directives
A copyright holder's systematic recording of IP addresses of file sharers, and the internet provider's disclosure of subscribers' names for a damages claim, can rest on legitimate interest, provided the request is justified, proportionate and not abusive, and any obligation to disclose is based on a legislative measure.
- C-511/18, La Quadrature du Net and Others v Premier ministre and Others (joined cases C-511/18, C-512/18 and C-520/18)
Judgment of 6 October 2020ECLI:EU:C:2020:791
Instrument: Mainly the ePrivacy Directive 2002/58; the GDPR is relied on only for one question
National laws may not require general and indiscriminate retention of traffic and location data as a preventive measure, subject to narrow exceptions (national security threats, IP addresses, civil identity, expedited retention under judicial control).
EDPB guidance
- Guidelines 10/2020 on restrictions under Article 23 GDPR
EDPB 10/2020FinalFirst published 18 December 2020Final version 13 October 2021