{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/articles/23","url":"https://www.headlesslaw.com/gdpr/articles/23","title":"Article 23 — Restrictions","family":"l1_generated","work_id":"gdpr","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":"2018-05-25","application":{"state":"applicable","next":null,"dates":[{"at":"2018-05-25","note":"Article 99(2)"}]},"version_label":"Consolidated version of 4 May 2016","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504","valid_from":"2016-05-04","valid_until":"2018-05-25","revision":1,"content_id":"197388a596507087","change_date":null,"nearest_versions":["2016-05-04"],"first_text_date":"2016-04-27","correction_applies":false,"versions":["2016-05-04"],"version_url":"https://www.headlesslaw.com/gdpr/articles/23/versions/2016-05-04","revision_url":"https://www.headlesslaw.com/gdpr/articles/23/versions/2016-05-04/rev/197388a596507087","versions_url":"https://www.headlesslaw.com/gdpr/articles/23/versions","relations_url":"https://www.headlesslaw.com/gdpr/articles/23/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/gdpr/articles/23.md","body_sha256":"00aea3079dc5fdd607ab9a665897b34719ed84c3bdc43389ee51c738b5c28fa1"},"units":[{"locator":"gdpr/art/23","kind":"article","status":"in_force","label":null,"heading":"Restrictions","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"gdpr/art/23/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:","marks":[],"revision":1,"text_hash":"6bb6f18b6a424bffd56bd9a8bb930f7d6f02343aef8e3226a03cb3990643343e","reason":null},{"locator":"gdpr/art/23/para/1/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"national security;","marks":[],"revision":1,"text_hash":"49db7f23abb821c9fb8c856cf9d42cfbd1afc944c87f60e922f663f902dbd80a","reason":null},{"locator":"gdpr/art/23/para/1/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"defence;","marks":[],"revision":1,"text_hash":"c8eeb1d816eb6a2e2a3055ce00b9cf3fcdf51641dfaabace387a607dc551cd08","reason":null},{"locator":"gdpr/art/23/para/1/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"public security;","marks":[],"revision":1,"text_hash":"e50acfc2b82683c2e6b2df99b4d88d4be2ca652e98a007c50a3f33748a82ae55","reason":null},{"locator":"gdpr/art/23/para/1/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;","marks":[],"revision":1,"text_hash":"3cd632890bb8f2cb48d0e268e493fbaa261ea6613b5ff40261ae29d08f860706","reason":null},{"locator":"gdpr/art/23/para/1/pt/e","kind":"point","status":"in_force","label":"(e)","heading":null,"text":"other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;","marks":[],"revision":1,"text_hash":"2ca7a6b30d69c36556a5867ac0e5d965cd12d24e4c369b4b49bf2cca7297d5cd","reason":null},{"locator":"gdpr/art/23/para/1/pt/f","kind":"point","status":"in_force","label":"(f)","heading":null,"text":"the protection of judicial independence and judicial proceedings;","marks":[],"revision":1,"text_hash":"ea972fe13f53cc2bbe75728a18191f51f809ab5a94a31744d2308345311ba3af","reason":null},{"locator":"gdpr/art/23/para/1/pt/g","kind":"point","status":"in_force","label":"(g)","heading":null,"text":"the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;","marks":[],"revision":1,"text_hash":"48bb274ef611ac565f4caa233ae665b1997565b2bad07e320e839f70060ae18d","reason":null},{"locator":"gdpr/art/23/para/1/pt/h","kind":"point","status":"in_force","label":"(h)","heading":null,"text":"a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);","marks":[],"revision":1,"text_hash":"f2c5939f1c411050a2e5e46229afa6a2f494986cb328905d7e54b95f2a6b70bf","reason":null},{"locator":"gdpr/art/23/para/1/pt/i","kind":"point","status":"in_force","label":"(i)","heading":null,"text":"the protection of the data subject or the rights and freedoms of others;","marks":[],"revision":1,"text_hash":"a6395f214ed00fc087f90adbc84f386e6e6a094a408a9ec03e0419bc8af2c1e6","reason":null},{"locator":"gdpr/art/23/para/1/pt/j","kind":"point","status":"in_force","label":"(j)","heading":null,"text":"the enforcement of civil law claims.","marks":[],"revision":1,"text_hash":"17e0c419e530fd5eb08492d1f2f37626f636ba8d915343ebc8430b32772e2474","reason":null},{"locator":"gdpr/art/23/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:","marks":[],"revision":1,"text_hash":"b3793215926970469c0b17dd0f55a868f32bff0c937cc6c91fbc023343cc4c89","reason":null},{"locator":"gdpr/art/23/para/2/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"the purposes of the processing or categories of processing;","marks":[],"revision":1,"text_hash":"17580a40b5207832426c61dba5ab2e39a80d173e322b9a318571b26d5f515635","reason":null},{"locator":"gdpr/art/23/para/2/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"the categories of personal data;","marks":[],"revision":1,"text_hash":"13dda5595c2ba92611a042ae45d76da4cf8adda47108adc9024f8cf4c7e2a3a5","reason":null},{"locator":"gdpr/art/23/para/2/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"the scope of the restrictions introduced;","marks":[],"revision":1,"text_hash":"ace1fda2a3b9552c1b2b38be320f7574299caa09c65e04c727b175d54bc9b382","reason":null},{"locator":"gdpr/art/23/para/2/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"the safeguards to prevent abuse or unlawful access or transfer;","marks":[],"revision":1,"text_hash":"aa86c0e8939729658f9803b5839f370c3bf76da1f79604145a98c36987ae1048","reason":null},{"locator":"gdpr/art/23/para/2/pt/e","kind":"point","status":"in_force","label":"(e)","heading":null,"text":"the specification of the controller or categories of controllers;","marks":[],"revision":1,"text_hash":"3f22773ab7ec81b0111a93fa837d6ed70418652e558c8d7b667e704522387f52","reason":null},{"locator":"gdpr/art/23/para/2/pt/f","kind":"point","status":"in_force","label":"(f)","heading":null,"text":"the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;","marks":[],"revision":1,"text_hash":"d7a827304849bf876e675a3517a57231b9517cfb3e9008b54a51f48492564f95","reason":null},{"locator":"gdpr/art/23/para/2/pt/g","kind":"point","status":"in_force","label":"(g)","heading":null,"text":"the risks to the rights and freedoms of data subjects; and","marks":[],"revision":1,"text_hash":"785588606dbb1dbec66818f253122c19599d3417f997654e36f644b857fe6c35","reason":null},{"locator":"gdpr/art/23/para/2/pt/h","kind":"point","status":"in_force","label":"(h)","heading":null,"text":"the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.","marks":[],"revision":1,"text_hash":"4deac253a6ba0b3ef3afe88e38b4d1af215f1e27ce37785e21bf2f0526b71597","reason":null}],"markdown":"---\ntitle: \"Article 23 — Restrictions\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504\"\nsource_retrieved: 2026-09-28\nshortTitle: \"Article 23 — Restrictions\"\ninstrument_type: level1_regulation\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Regulation (EU) 2016/679\"\ninstrument: gdpr\ncelex: \"32016R0679\"\nregulation: GDPR\nregulation-full: \"Regulation (EU) 2016/679\"\narticle: 23\nstatus: in_force\nobject_id: eu.gdpr.legal_text.article.23\ntext_version: \"Consolidated version of 4 May 2016\"\nsource_url: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Consolidated version of 4 May 2016 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504)*\n\n1. <a id=\"p-1\"></a>Union or Member State law to which the data [controller](https://www.headlesslaw.com/definitions/gdpr/controller) or [processor](https://www.headlesslaw.com/definitions/gdpr/processor) is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in [Articles 12](12.md) to 22 and [Article 34](34.md), as well as [Article 5](5.md) in so far as its provisions correspond to the rights and obligations provided for in [Articles 12](12.md) to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:\n\n    <a id=\"p-1-a\"></a>**(a)** national security;\n\n    <a id=\"p-1-b\"></a>**(b)** defence;\n\n    <a id=\"p-1-c\"></a>**(c)** public security;\n\n    <a id=\"p-1-d\"></a>**(d)** the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;\n\n    <a id=\"p-1-e\"></a>**(e)** other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;\n\n    <a id=\"p-1-f\"></a>**(f)** the protection of judicial independence and judicial proceedings;\n\n    <a id=\"p-1-g\"></a>**(g)** the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;\n\n    <a id=\"p-1-h\"></a>**(h)** a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);\n\n    <a id=\"p-1-i\"></a>**(i)** the protection of the data subject or the rights and freedoms of others;\n\n    <a id=\"p-1-j\"></a>**(j)** the enforcement of civil law claims.\n2. <a id=\"p-2\"></a>In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:\n\n    <a id=\"p-2-a\"></a>**(a)** the purposes of the [processing](https://www.headlesslaw.com/definitions/gdpr/processing) or categories of processing;\n\n    <a id=\"p-2-b\"></a>**(b)** the categories of [personal data](https://www.headlesslaw.com/definitions/gdpr/personal-data);\n\n    <a id=\"p-2-c\"></a>**(c)** the scope of the restrictions introduced;\n\n    <a id=\"p-2-d\"></a>**(d)** the safeguards to prevent abuse or unlawful access or transfer;\n\n    <a id=\"p-2-e\"></a>**(e)** the specification of the controller or categories of controllers;\n\n    <a id=\"p-2-f\"></a>**(f)** the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;\n\n    <a id=\"p-2-g\"></a>**(g)** the risks to the rights and freedoms of data subjects; and\n\n    <a id=\"p-2-h\"></a>**(h)** the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.\n\n## Related Level 2 and Level 3\n\n### Guidance and Q&A\n\n- [EDPB 10/2020 — Guideline — Restrictions under Article 23 \\[final\\]](../level-3/guidelines/edpb-10-2020-article-23-restrictions.md)\n\n***\n\n[Chapter III — Rights of the data subject](../chapters/iii.md) · [← Article 22](22.md) · [Article 24 →](24.md)\n"}