A controller or processor served with an enforcement notice must take the measures it specifies within the period it sets (at least 21 days) and, no later than 21 days after complying, notify the data subject concerned of any amendment and, where compliance materially modifies the data, every person to whom the data were disclosed from 12 months before service of the notice until compliance. Failure without reasonable excuse is an offence (fine up to Rs 50,000, up to 2 years); the notice may be appealed to the ICT Appeal Tribunal within 21 days.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.