A data subject may by written notice require the data controller, within a reasonable period, to stop or not begin processing (or processing for a purpose or in a manner) that is causing or likely to cause unwarranted substantial damage or distress to them or another, unless they consented or the processing is necessary for a contract, pre-contract steps, a legal obligation or vital interests. Within 21 days the controller must reply in writing that it has complied or will comply, or why it considers the notice unjustified and to what extent it will comply; the Commissioner may order compliance, and failing to comply with that order is an offence (fine up to RM200,000, imprisonment up to two years or both).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.