Data subjects may object where third parties' rights are not affected, the law allows it and the data are not public, of public interest or processing ordered by law; at any time to processing for direct marketing including related profiling, after which the data are no longer processed for those purposes; and, on grounds relating to their particular situation, to processing based on legitimate interest unless a law provides otherwise. The controller stops processing unless it proves compelling legitimate grounds overriding the data subject's interests, rights and freedoms or needs the data for legal claims, and must answer within 15 days.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.