Designing objection and restrict processing UI in Figma: pause use, legal bases, and feature limits

Quick answer

Objection and restrict-processing UI lets users pause specific uses of their data—marketing, profiling, fraud scoring—without deleting the account. Design purpose-level objection toggles, a processing freeze banner when restriction is active, admin objection review for competing legal grounds, and clear feature limits (what still works vs what stops). Start from the Figma guides hub and pair with privacy settings, LIA workflow, consent withdrawal, erasure requests, and Dev Mode handoff.

---

Who this is for

• Product designers adding “stop using my data for X” controls beyond marketing unsubscribe.
• Privacy teams separating Art. 21 objection from Art. 18 restriction and documenting overrides.
• Engineering teams gating features when processing is restricted but storage remains.

---

Processing rights hub (admin overview)

ProcessingRightsHub — Acme App · 42 active restrictions · 8 pending objections
├── Header: Marketing objections 31 · Profiling objections 6 · Fraud LI disputes 5
├── Actions: [ Objection queue ] [ Override log ] [ Feature flag map ] [ LIA sync ]
├── Tabs: Objections · Restrictions · Overrides · Denied · Audit
├── Alert: OBJ-771 · User u_441 · Fraud scoring objection · Competing vital interest review
├── Filters: Legal basis · Purpose · Region · Feature impact · Status
└── Link: [Privacy settings](/designing-privacy-settings-and-data-management-ui-in-figma/) · [LIA](/designing-legitimate-interest-assessment-workflow-ui-in-figma/) · [ROPA](/designing-records-of-processing-activities-and-data-mapping-ui-in-figma/)

Section	Purpose
Objections	Art. 21 requests—especially legitimate interest processing
Restrictions	Art. 18 freezes—data stored but use limited
Overrides	Documented when org continues processing despite objection
Denied	Clear rationale + appeal (e.g., legal claim defense)
Audit	Proof for regulators and internal privacy review

Verdict: Restriction fails when the app looks normal but silently stops honoring objections—show freeze state in UI and admin queues.

---

Purpose-level objection registry

ObjectionRegistry — Per-purpose controls · Linked to ROPA
├── marketing_email
│   ├── Basis: Consent · Objection path: [Withdraw consent](/designing-consent-withdrawal-and-downstream-deletion-ui-in-figma/) · Immediate
│   ├── UI: Toggle in [notification prefs](/designing-notification-preferences-and-communication-settings-ui-in-figma/)
│   └── Not Art. 21—use consent withdraw copy
├── product_analytics
│   ├── Basis: Legitimate interest · Objection: Art. 21(1) · Review within 30d
│   ├── UI: "Object to analytics" · Impact: No product improvement surveys · Core app works
│   └── Link [LIA record](/designing-legitimate-interest-assessment-workflow-ui-in-figma/) LIA-019
├── fraud_and_abuse_scoring
│   ├── Basis: LI + vital interests · Objection may be denied · Show review state
│   ├── UI: Object button · Explanation: May continue if overriding reasons apply
│   └── Override template required in admin
├── personalized_recommendations
│   ├── Basis: Consent or LI per region · Objection stops ranking · Fallback to popular items
│   ├── Feature limit: [Recommendations UI](/designing-product-recommendations-ui-in-figma/) shows generic list
│   └── Pairs with [automated decisions](/designing-automated-decision-making-and-profiling-transparency-ui-in-figma/)
├── workplace_monitoring
│   ├── B2B only · Employee objection flow · HR review queue
│   └── Do not reuse consumer [privacy settings](/designing-privacy-settings-and-data-management-ui-in-figma/) card
└── [ Add purpose ] · Must map legal_basis · feature_flags[] · objection_allowed boolean

Each purpose needs one clear control—not a wall of undifferentiated toggles.

---

Customer objection flow (legitimate interest)

ObjectionFlow — Product analytics · Basis: Legitimate interest
├── Header: Object to analytics processing
├── Plain language: "We use usage data to improve features. You can object to this use."
├── What stops: Feature polls · A/B assignment · Aggregated improvement metrics tied to you
├── What continues: Security logs · Billing · Support tickets · Legal obligations
├── What we may still do: If we have compelling grounds, we'll explain in writing within 30 days
├── Confirm: [ Submit objection ] · Creates objection_id · Status: Received
├── Post-submit: Banner "Analytics processing restricted" · Link [restrict status](#processing-freeze-banner)
└── Alternative: [ Delete analytics data instead ] · Links [erasure wizard](/designing-right-to-erasure-and-deletion-request-ui-in-figma/) scope marketing_and_analytics

Objection is not deletion—copy must say data may be stored but not used for that purpose.

---

Restrict processing request (Art. 18)

RestrictProcessing — User disputes accuracy · Art. 18(1)(d)
├── Trigger: From [rectification flow](/designing-data-accuracy-and-rectification-rights-ui-in-figma/) · "Restrict use while we verify"
├── Effect: Profile fields hidden from team views · Not deleted · Edit locked until resolved
├── Banner (global): "Processing restricted · Some sharing paused" · Dismissible per session · Persistent in settings
├── Admin queue: RES-112 · Verify within SLA · Approve lift or apply correction
├── User options: [ Lift restriction ] (if resolved) · [ Erasure instead ] · [ Export data ]
└── Downstream: API returns restricted=true on affected resources · Dev handoff critical

Restriction often pairs with accuracy disputes—wire both from the same profile surface.

---

Processing freeze banner (in-app)

ProcessingFreezeBanner — Sticky · analytics + recommendations restricted
├── Icon + text: "You've limited how we use your data. Personalized recommendations are off."
├── Details expand: Active restrictions list · Date applied · Reference OBJ-771
├── Actions: [ Manage in Privacy settings ] [ Learn about your rights ]
├── Do not use: Alarming red error styling · Implies account suspended incorrectly
├── a11y: role=status · Announced once on load · [Inline alerts](/designing-inline-alerts-and-banners-in-figma/) pattern
└── Hidden when: No active restrictions · User is guest

Freeze banners set expectations when features degrade gracefully instead of breaking.

---

Feature limit matrix (design reference)

Purpose restricted	User-visible change	Backend flag
Analytics LI	No in-app surveys	analytics_restricted
Recommendations	Generic catalog	personalization_off
Profiling / auto decisions	Manual review queue	profiling_restricted
Marketing (consent)	Unsubscribe confirm	marketing_consent false
Full Art. 18 restrict	Limited sharing + edit lock	processing_restricted global
Fraud (denied objection)	No change + explanation letter	objection_denied

Design empty and fallback states for each limited feature—not broken layouts.

---

Admin objection review (competing grounds)

ObjectionReview — OBJ-771 · Fraud scoring · Submitted 2026-08-12
├── User request: "Stop automated fraud scoring on my account"
├── LIA on file: LIA-044 · Last reviewed 2026-03-01 · [Open LIA](/designing-legitimate-interest-assessment-workflow-ui-in-figma/)
├── Competing grounds checklist:
│   ├── ☐ Compelling legitimate grounds override · Document:
│   ├── ☐ Legal claims · Litigation hold
│   ├── ☐ Vital interests · Rare · Legal sign-off
│   └── ☐ Public interest · Government only
├── Decision: [ Uphold objection ] [ Deny with reason ] [ Partial—limit scope ]
├── User notification template: Plain language · Appeal to DPO · SLA met date
├── If upheld: Flip feature_flags · Remove user from scoring pipeline · Audit entry
└── Export: [Compliance bundle](/designing-compliance-exports-and-legal-hold-ui-in-figma/)

Denials require written, specific reasons—not template “we declined.”

---

Comparison: objection vs restrict vs withdraw vs erase

Right	Data stored?	Processing	Reversible?
Object (Art. 21)	Usually yes	Stops for that purpose	User can withdraw objection
Restrict (Art. 18)	Yes	Frozen except storage	Lift when dispute resolved
Withdraw consent	May delete	Stops consent-based use	Re-consent possible
Erasure (Art. 17)	Deleted (exceptions)	Stops entirely	Irreversible
Deactivate account	Yes	Login paused	User reactivates

Use distinct entry labels in privacy settings—users confuse “stop emails” with “restrict all processing.”

---

Handoff checklist (Dev Mode)

• ProcessingPurpose — purpose_id, legal_basis, objection_allowed, restriction_allowed, lia_ref.
• ObjectionRequest — objection_id, user_id, purpose_id, status, submitted_at, decision_at, denial_reason.
• ProcessingRestriction — restriction_id, trigger (art18|manual), scopes[], lift_condition.
• FeatureLimit — purpose_id, ui_fallback_component, api_flag_name, empty_state_copy.
• FreezeBanner — active_restrictions[], settings_deep_link, announce_on_load.
• ObjectionDecision — upheld|denied|partial, legal_ground_code, user_message_template.
• Accessibility — toggles labeled with purpose; banner not color-only; focus to settings link.

---

Common mistakes

Mistake	Why it hurts	Fix
Marketing unsubscribe = full objection	Wrong legal basis	Separate consent vs LI controls
Objection with no feature fallback	Broken recommendations UI	Generic fallback states
Silent deny	Art. 21 compliance failure	User notification + appeal
Restrict without API flag	Data still shared	Dev handoff matrix
Same toggle for erase and restrict	Irreversible mistakes	Separate flows
Fraud objection auto-granted	Security risk	Review queue + override log
No LIA link in admin	Cannot defend LI	Purpose registry ↔ LIA ID
Alarmist freeze banner	Users think banned	Neutral status styling

---

Recommended workflow

1. Map purposes and legal bases in ROPA (ROPA UI).
2. Design privacy settings section “Limit how we use your data” with purpose cards.
3. Build objection flow for LI purposes with impact preview and SLA messaging.
4. Design Art. 18 restrict entry from rectification disputes (accuracy UI).
5. Define feature limits and fallbacks per purpose—coordinate with feature teams.
6. Admin review queue with LIA links and override documentation.
7. Add freeze banner and test with Dev Mode flags.

---

FAQ

Objection vs consent withdrawal?

Consent withdrawal applies to consent-based processing; objection targets legitimate interest and direct marketing in some regions.

Can users restrict and still use the product?

Yes—Art. 18 and partial objections limit specific uses; core contract features usually continue.

Link to automated decisions?

Profiling objections should surface logic explanation and human review entry when required.

Erasure after objection?

Offer erasure scope when user wants deletion, not just pause.

Employee objections?

Workplace monitoring needs HR admin review—separate B2B surfaces from consumer privacy settings.

---

Next steps

• Design privacy settings and data management UI in Figma — central entry for objection and restrict controls
• Design legitimate interest assessment workflow UI in Figma — document LI before enabling objection review
• Design right to erasure and deletion request UI in Figma — when pause is not enough
• Design data accuracy and rectification rights UI in Figma — trigger Art. 18 restrict from disputes
• Design automated decision-making and profiling transparency UI in Figma — pair with profiling objections