The data subject may obtain restriction where accuracy is contested (while it is verified), processing is unlawful but they oppose erasure, the controller no longer needs the data but they need it for legal claims, or they have objected under Article 19(1) pending verification of whose grounds prevail. Restricted data may, apart from storage, be processed only with consent, for legal claims, to protect another person's overriding rights or for an important public interest. The data subject must be told before a restriction is lifted. If the controller refuses, the data subject may complain and ask the Commissioner for a preliminary restriction order, issued where necessary and proportionate within 14 days. The controller must inform every recipient to which the data were disclosed of the restriction.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.