The data subject may at any time request cancellation of their data from the controller's files, records and systems. Cancellation leads to a blocking period equal to the limitation period of actions arising from the legal relationship, during which data are kept only for liabilities, then suppression, and the data subject is notified once cancelled; where the data were transmitted earlier and are still processed by third parties, the controller must tell them of the rectification or cancellation so they apply it too. Cancellation is not required where the data concern parties to a contract and are needed for it, must be processed by law, would obstruct tax, criminal or sanction proceedings, protect the data subject's legal interests, serve the public interest, fulfil an obligation the data subject acquired, or are processed for medical prevention, diagnosis or health service management by a professional bound by secrecy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.