Articles 63 to 66 and 64-2: the Commission may demand materials, inspect premises, carry out preventive inspections of high-risk controllers (with corrective recommendations to accept within ten days), order corrective measures and publish results; it may impose surcharges of up to 3 percent of total revenue (excluding revenue unrelated to the violation) for unlawful processing, children's data without parental consent, sensitive or identifier violations, poor processor supervision, re-identification, unlawful transfers, ignoring suspension orders, or leaks without adequate safeguards; from 11 September 2026 up to 10 percent for wilful or grossly negligent repeat violations within three years, violations affecting ten million or more people, or leaks after ignoring a corrective order, with reductions for protection investment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.