The following data subjects' rights explicitly provide for the possibility that the EU or the Member States may restrict these rights:

Art. 14 V c: "Paragraphs 1 to 4 [information obligation] shall not apply where and insofar as obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests."

 

Art. 14 V d: "Paragraphs 1 to 4 [information obligation] shall not apply where and insofar as where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy."

 

Art. 17 III b: “Paragraphs 1 and 2 [right to erasure] shall not apply to the extent that processing is necessary for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”

Art. 23 GDPR also provides for numerous other possible restrictions.