Under the GDPR, the right to restrict processing can be exercised by individuals with regard to their personal data. When they do, all you will be allowed to do is store it. Do not confuse with the right to erasure – it is true that the two rights are often discussed together and the some situations in which an individual can request either of them are similar, but they are different rights.
A data subject can restrict processing of their personal data when they believe the data is not accurate. In this situation, the processing should be restricted until the accuracy of the data is verified. Also, processing will be restricted when the individual objects to it – if the data had been necessary for the performance of a public task but you, as an organization, are unsure of your legitimate grounds. Also, restriction will be mandatory when the processing has been unlawful but the data subject refuses erasure. Finally, if you no longer need the data but the individual does not want the data to be erased because they need to to exercise a legal claim, the restriction of processing will come into effect again.
If you’ve shared the personal data with a third party, you should inform them when the individual exercises the right to restrict processing, unless this is impossible.