Where the Commission is satisfied that a controller or processor has violated or is likely to violate the Act or its subsidiary legislation it may make a compliance order: a warning that an act or omission is likely to be a violation, a requirement to comply with the provisions including honouring a data subject's rights requests, or a cease and desist order to stop or refrain from an act including processing the personal data concerned; the order is in writing and specifies the provisions violated, the specific measures to avoid, remedy or eliminate the situation, the period to implement them and the right to judicial review under section 50; the organisation implements the measures within the period, failure being an offence under section 49.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.