The organization must have policies, procedures or mechanisms that let individuals see, correct and erase their personal data without undue delay. It must set a response time and keep to it; carry corrections and erasures through its systems and to authorized users, and pass them on to third parties that received the data; provide a way to resolve disputes over accuracy or correction, which includes explaining to the individual what was changed and, where a correction was not possible, why; and stay up to date with jurisdictional limits on when and how such requests may be made.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.