Where erasure of non-automated data is impossible or disproportionate because of the storage method and the data subject's interest is minimal, restriction under GDPR Art. 18 replaces erasure (not where the processing was unlawful). The same applies to erasure under Art. 17(1)(a) and (d) where the controller has reason to think erasure would harm the data subject's legitimate interests, in which case the data subject is told of the restriction unless impossible or disproportionate; and to Art. 17(1)(a) where statutory or contractual retention periods stand against erasure.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.