According to article 18 of the GDPR, the data subject shall have the right to obtain from the controller restriction of processing where one of the circumstances described in this article applies (namely: the accuracy of their data is contested; the processing is unlawful and the data subject opposed erasure of their personal data; the controller no longer needs the personal data, but is required to store it; or the data subject otherwise objects to the processing).

Since a controller other than the social network who originally gathered the data is involved in the processing, it might be good to keep in mind that this right shall be exercised through any of the actors involved, who should inform the rest about the requirement and proceed accordingly. In this context, it can be very useful to develop data sharing agreements that help to clarify the responsibilities attributed to each of these roles in the performance of the specific data processing activities to be carried out, if the developer policies do not clarify this issue.