The controller rectifies inaccurate data without delay (restricting where accuracy cannot be established), completes incomplete data, erases data processed unlawfully or no longer needed or to meet a legal obligation, restricts instead of erasing where erasure would harm the data subject, evidence must be kept or erasure is impracticable, makes restriction visible in automated systems, informs the source and recipients of rectifications, erasures and restrictions and tells the data subject in writing of refusals. Under Article 73 as replaced by Law 5002/2022 the law sets storage periods and data are erased at their end; where the law provides periodic review of retention, the criteria include the data subject category, age, offence gravity, threat, pending investigations, limitation and recidivism, the DPO takes part in the reviews, and the controller builds these requirements into system design.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.