Restriction of right of access by data subjects, right to rectification, right of erasure or restriction of processing
Article 5
1. Where the controller restricts, wholly or partially, the right of access, the right to rectification, the right of erasure or the right to restriction of processing, respectively referred to in Articles 17, 18, 19(1) and 20(1) of Regulation (EU) 2018/1725, it shall, within the period referred to in Article 11(5) of Decision (EU) 2020/655 (ECB/2020/28), inform the data subject concerned, in its written reply to the request, of the restriction applied, the principal reasons for the restriction, the possibility of lodging a complaint with the European Data Protection Supervisor and of seeking a judicial remedy in the Court of Justice of the European Union. 2. The controller shall keep the internal assessment note referred to in Article 3(3) and, where applicable, the documents containing underlying factual and legal elements and make these available to the DPO and European Data Protection Supervisor on request. 3. The controller may defer, omit or deny the provision of information concerning the reasons for the restriction referred to in paragraph 1 for as long as that provision of information would undermine the purpose of the restriction. As soon as the controller determines that providing the information no longer undermines the purpose of the restriction, the controller shall provide that information to the data subject.