At a data subject's request the controller may restrict processing while contested accuracy is verified, where the controller no longer needs the data but the person needs them for legal claims, where processing is unlawful and the person prefers restriction to erasure, or pending verification of an objection. Restricted data are, apart from storage, processed only with consent or for legal claims, protecting another person's rights or public interest, and the person is told before a restriction is lifted. The controller implements mechanisms to ensure the time limits for rectification, erasure, restriction and periodic review of the need for storage are observed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.