Article 37: data subjects may request suspension of processing or withdraw consent (for public institutions, for registered files); the controller suspends all or part without delay unless a law requires otherwise, others' interests would be harmed, a public task could not be performed, or the contracted service could not be provided and the person has not clearly ended the contract; on withdrawal it destroys the collected information irrecoverably; it explains any refusal and destroys information whose processing was stopped.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.