Where GDPR art. 8 (information society services offered directly to a child) does not apply and processing relies on consent, a data subject who has not reached sixteen cannot consent alone: the legal representative must consent in the child's place. Art. 5(1) to (4) do not apply where a special regime under Book 7, title 7, section 5 of the Civil Code (the medical treatment agreement) governs (5(7)), nor to help and advice services provided to a minor or ward directly and at no cost (5(6)). A minor of sixteen or over may litigate alone over a breach of his GDPR rights (5(5)).
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.