Subject to the qualifications and to legal or contractual retention duties, individuals can withdraw consent and ask the organisation to stop using or disclosing their personal information once it is no longer needed for the purposes consented to, through mechanisms that are in place and operational. New requirement in the updated set; Accountability Agents certify against it from 1 April 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.