Beyond GDPR Art. 13(4), information on intended further use under Art. 13(3) need not be given where it concerns analogue data and the controller contacts the data subject directly by non-digital means for a compatible purpose and the interest in information is minimal; where it would endanger a public body's proper performance of tasks under Art. 23(1)(a) to (e); where it would put public security or order at risk or harm the Federation or a Land; where it would interfere with legal claims; or where it would endanger a confidential transfer to public bodies; in the public-task, security and legal-claims cases only where the controller's interest in not informing outweighs the data subject's. If information is withheld the controller must take measures to protect the data subject, including publishing the Art. 13(1) and (2) information in clear, accessible form, and record its reasons in writing; neither step applies in the legal-claims and confidential-transfer cases. Where the obstacle is temporary the information follows within a reasonable period after it ends, at the latest two weeks.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.