--- title: "Article 23 — Restrictions" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504" source_retrieved: 2026-09-28 shortTitle: "Article 23 — Restrictions" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2016/679" instrument: gdpr celex: "32016R0679" regulation: GDPR regulation-full: "Regulation (EU) 2016/679" article: 23 status: in_force object_id: eu.gdpr.legal_text.article.23 text_version: "Consolidated version of 4 May 2016" source_url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504" check_status: matched verified: true last_checked: 2026-10-26 --- *In force · Consolidated version of 4 May 2016 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504)* 1. Union or Member State law to which the data [controller](https://www.headlesslaw.com/definitions/gdpr/controller) or [processor](https://www.headlesslaw.com/definitions/gdpr/processor) is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in [Articles 12](12.md) to 22 and [Article 34](34.md), as well as [Article 5](5.md) in so far as its provisions correspond to the rights and obligations provided for in [Articles 12](12.md) to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: **(a)** national security; **(b)** defence; **(c)** public security; **(d)** the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; **(e)** other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security; **(f)** the protection of judicial independence and judicial proceedings; **(g)** the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions; **(h)** a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g); **(i)** the protection of the data subject or the rights and freedoms of others; **(j)** the enforcement of civil law claims. 2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to: **(a)** the purposes of the [processing](https://www.headlesslaw.com/definitions/gdpr/processing) or categories of processing; **(b)** the categories of [personal data](https://www.headlesslaw.com/definitions/gdpr/personal-data); **(c)** the scope of the restrictions introduced; **(d)** the safeguards to prevent abuse or unlawful access or transfer; **(e)** the specification of the controller or categories of controllers; **(f)** the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; **(g)** the risks to the rights and freedoms of data subjects; and **(h)** the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction. ## Related Level 2 and Level 3 ### Guidance and Q&A - [EDPB 10/2020 — Guideline — Restrictions under Article 23 \[final\]](../level-3/guidelines/edpb-10-2020-article-23-restrictions.md) *** [Chapter III — Rights of the data subject](../chapters/iii.md) · [← Article 22](22.md) · [Article 24 →](24.md)