I need certain Instagram or Facebook records kept, but not used as usual. What can I ask for?
The short answer
Article 18 of the EU GDPR provides a limited right to restrict processing while data is retained. It can help when accuracy is disputed, an eligible objection is being assessed, processing is unlawful but you oppose deletion, or you need data for legal claims after the controller no longer needs it. Identify the relevant data and the applicable reason; this is not a general freeze of your account.
What this answer is based onWhat to do
Prepare the account identifier, exact records and dates, the reason for restriction, previous request references and only the evidence needed to explain them. Save material you already lawfully hold privately. Do not delete your own evidence or send a whole conversation when a short extract is enough.
- Check whether EU GDPR applies and choose the reason. It can cover processing linked to an EU establishment and certain services offered to, or monitoring of, people in the EU; citizenship alone is not the test. Specify one of the four grounds above. For accuracy disputes, restriction lasts while accuracy is verified; for an Article 21 objection, while the controller checks whether its grounds override yours. Explain the records needed for a legal claim if that is your ground, rather than requesting indefinite retention of everything.
- Use the responsible controller’s verified privacy contact or data-protection officer listed in the current service privacy notice. Adapt this request: “For account [identifier], please restrict processing under GDPR Article 18 of [records and dates], because [specific applicable reason and brief facts]. I request restricted retention rather than erasure of these records. Please confirm what is restricted, explain any refusal, and notify me before lifting the restriction.” Ask about notifying recipients under Article 19 where relevant. Provide only necessary identity evidence through a verified channel if reasonably required; never include a password or login code.
- Keep the request, proof of receipt and reply. A response is normally due within one month of receipt; a necessary extension of up to two further months must be explained within the first month. Requests are normally free, with limited exceptions for manifestly unfounded or excessive requests. If the reply misses the specified records, clarify that gap. If unresolved or unanswered, follow the competent data-protection authority’s complaint instructions, using the EDPB directory, and include relevant correspondence. Ask a qualified adviser promptly if evidence may disappear or a legal deadline is near; this request does not pause court or platform-appeal deadlines.
The situation
For example, you dispute the accuracy of a personal-data record and have requested correction. You can also ask for its use to be restricted while accuracy is checked, instead of asking for the record to disappear.
The situation and an improvement
Ask for deletion when the same records may still be needed as evidence.
Identify the records, check a valid restriction ground and request limited use with retention.
More examples
The controller no longer needs the records
You need personal data about you to establish, exercise or defend a legal claim.
What to do
Identify the particular records and explain that purpose in a restriction request. Do not treat it as a guaranteed litigation hold for all platform data; seek legal advice for urgent preservation.
A restriction is about to end
The controller says it has completed the accuracy check or assessed your objection.
What to do
Read its reasons and check whether they address your evidence. Preserve the notice and correspondence for any complaint; restriction can be lifted after notice and is not necessarily permanent.
What this answer is based on
Irish DPC · Right to restriction under GDPR Article 18www.dataprotection.ieEDPB · Restriction, recipients and handling rights requestsEuropean Commission · Restriction and exercising privacy rightsEuropean Commission · When GDPR appliesEDPB · National data protection authoritiesPrimary source readReview details
Source reviewed:
We read the official source listed for this topic. Other Meta rules are reviewed separately.
Read the official Irish DPC, EDPB and European Commission guidance on the four grounds, permitted uses, notice before lifting restriction, request handling and GDPR scope on 13 November 2026. No Meta account, submission form or individual legal claim was tested. The request wording and evidence checklist are ClearRules editorial help, not a prescribed form or a preservation guarantee.
Include the guide link, language and wording that needs checking. Add an official source link if you have one. Do not send passwords, login codes or photos of identity documents.
Examples are made up to explain the guidance. Meta decides individual account and content cases.
Sources and related topicsPolicy Graph · Demo in development