--- title: "Art. 23 GDPR: Restrictions" canonical: "https://dposchool.com/gdpr/article/23" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_23" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 23 GDPR · Chapter III: Rights of the data subject · Section 5: Restrictions # Article 23 GDPR: Restrictions Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Union or Member State law may restrict the scope of certain obligations and rights in the Regulation when the restriction respects the essence of fundamental rights and is a necessary and proportionate measure to safeguard one of the interests listed, such as national security or the prevention of crime. Such laws must contain the specific provisions listed in paragraph 2. ## Official text ### Article 23(1) **1.** Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: #### Article 23(1)(a) **(a)** national security; #### Article 23(1)(b) **(b)** defence; #### Article 23(1)(c) **(c)** public security; #### Article 23(1)(d) **(d)** the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; #### Article 23(1)(e) **(e)** other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security; #### Article 23(1)(f) **(f)** the protection of judicial independence and judicial proceedings; #### Article 23(1)(g) **(g)** the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions; #### Article 23(1)(h) **(h)** a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g); #### Article 23(1)(i) **(i)** the protection of the data subject or the rights and freedoms of others; #### Article 23(1)(j) **(j)** the enforcement of civil law claims. ### Article 23(2) **2.** In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to: #### Article 23(2)(a) **(a)** the purposes of the processing or categories of processing; #### Article 23(2)(b) **(b)** the categories of personal data; #### Article 23(2)(c) **(c)** the scope of the restrictions introduced; #### Article 23(2)(d) **(d)** the safeguards to prevent abuse or unlawful access or transfer; #### Article 23(2)(e) **(e)** the specification of the controller or categories of controllers; #### Article 23(2)(f) **(f)** the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; #### Article 23(2)(g) **(g)** the risks to the rights and freedoms of data subjects; and #### Article 23(2)(h) **(h)** the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 23 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_23) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 41](https://dposchool.com/gdpr/recital/41) ## Court of Justice judgments ### [C-307/22, FT v DW](https://dposchool.com/gdpr/case/c-307-22) Judgment of 26 October 2023 · ECLI:EU:C:2023:811 The first copy of one's data must be free even if the request has no data protection motive; national law cannot make patients pay for it; a patient is entitled to a full copy of medical records where needed to check accuracy. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-307/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307) ### [C-175/20, SIA 'SS' v Valsts ieņēmumu dienests](https://dposchool.com/gdpr/case/c-175-20) Judgment of 24 February 2022 · ECLI:EU:C:2022:124 A tax authority that collects large amounts of personal data from a business must respect the principles in Art. 5(1); it may only derogate from them on the basis of a legislative measure under Art. 23(1). [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-175/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0175) ### Related (earlier law or other instruments) #### [C-597/19, Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA](https://dposchool.com/gdpr/case/c-597-19) Judgment of 17 June 2021 · ECLI:EU:C:2021:492 Instrument: GDPR together with the IP Enforcement and ePrivacy Directives A copyright holder's systematic recording of IP addresses of file sharers, and the internet provider's disclosure of subscribers' names for a damages claim, can rest on legitimate interest, provided the request is justified, proportionate and not abusive, and any obligation to disclose is based on a legislative measure. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-597/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0597) #### [C-511/18, La Quadrature du Net and Others v Premier ministre and Others (joined cases C-511/18, C-512/18 and C-520/18)](https://dposchool.com/gdpr/case/c-511-18) Judgment of 6 October 2020 · ECLI:EU:C:2020:791 Instrument: Mainly the ePrivacy Directive 2002/58; the GDPR is relied on only for one question National laws may not require general and indiscriminate retention of traffic and location data as a preventive measure, subject to narrow exceptions (national security threats, IP addresses, civil identity, expedited retention under judicial control). [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-511/18&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0511) ## EDPB guidance ### [Guidelines 10/2020 on restrictions under Article 23 GDPR](https://dposchool.com/gdpr/guidance/edpb-10-2020) EDPB 10/2020 · Final · First published 18 December 2020 · Final version 13 October 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-102020-on-restrictions-under-article-23-gdpr_en) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 23 Previous: [Art. 22 GDPR: Automated individual decision-making, including profiling](https://dposchool.com/gdpr/article/22) Next: [Art. 24 GDPR: Responsibility of the controller](https://dposchool.com/gdpr/article/24) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents