The controller must rectify inaccurate data and complete incomplete data as soon as possible, and erase data immediately where processing is unlawful (in particular in breach of Articles 6 or 49 to 52) or a legal obligation requires it. Instead of erasure it must restrict processing where accuracy is contested and cannot be established, or the data must be kept as evidence for a legal task, and inform the data subject before lifting a restriction based on contested accuracy. Refusals must be given in writing, restricted only as necessary and proportionate for Article 55(3) purposes, with the possibility to complain to the Commissioner. Rectifications must be communicated to the authority from which the inaccurate data came, and all recipients notified to rectify, erase or restrict in turn.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.