Your organisation has appropriate methods and procedures in place to restrict the processing of personal information, if required.
Best Practice
Your organisation restricts personal information in a way appropriate for the type of processing and the system, for example temporarily moving the information to another system or removing it from a website.
If the personal information has been disclosed to others, your organisation contacts each recipient to tell them about the restriction, unless this is impossible or involves disproportionate effort.
If asked to, your organisation has a process in place to inform the individual of the third parties that will or have already received their personal information.
Accountability Check
Would team members state that the organisation has effective processes in place to restrict personal information?
Would requesters say that they received clear information about the steps taken?