Articles 29 to 32 and 75 with Decree Articles 67 to 75: the CDP may warn a controller and serve formal notice to end breaches within a set period; if the notice is not complied with, after an adversarial procedure (hearing notice at least fifteen days before, eight in urgency) it may provisionally withdraw an authorisation for three months, becoming final, or impose a fine of one to one hundred million CFA francs (not on the State or public-service bodies, where the Prime Minister is informed instead); in urgency it may interrupt processing or lock data for up to three months or prohibit processing; decisions are reasoned, published in the Journal officiel within a month of becoming final, and appealable to the Conseil d'Etat; offences are punished under the Penal Code and the cybercrime law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.