Where processing is based on the performance of a public interest task, official authority or legitimate interests, including profiling on those bases, the data subject may object at any time on grounds relating to their particular situation, and processing must stop unless the controller demonstrates compelling legitimate grounds that override the data subject's interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing, including profiling related to that marketing, the objection is absolute and processing for that purpose must stop with no balancing. Bring the right explicitly to the data subject's attention at the latest at the time of the first communication, presented clearly and separately from any other information. In the context of information society services, allow the objection to be exercised by automated means using technical specifications. A separate right to object applies to research and statistical processing under Article 89(1) unless that processing is necessary for a public interest task.
GDPR GDPR-Art.21 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of GDPR your existing evidence covers. Hold ISO 27701:2019 and 21 of 40 GDPR controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the ISO 27701:2019 pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.