Articles 82 to 86: data subjects may complain to the Commissioner, which keeps them informed and tells them of court routes; any person affected by a Commissioner decision may bring an administrative dispute within 30 days, and a complainant may do so if the Commissioner does not act within 60 days; data subjects may also sue the controller or processor in court directly and may authorise an association protecting data subjects' rights to represent them; anyone suffering material or non-material damage from a breach of the Law may claim compensation from the controller or processor, the processor being liable only for its own duties or for acting outside instructions, and exempt if it proves it is not responsible.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.