The data subject may require the controller to restrict and stop processing while the accuracy of the data is contested (for a period to allow verification), where the processing departs from the agreed purposes, or where it breaches the Decree-Law; and may ask the controller to keep the data after the purposes end where needed for legal claims. The controller may still process restricted data without consent where processing is limited to storage, needed for legal claims or judicial proceedings, to protect third parties' rights, or to protect the public interest, and must notify the data subject when it lifts a restriction.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.