Controllers and processors must not obstruct the Commission, refuse entry or access to documents and devices, withhold requested information or give false information (an offence); as respondents to a complaint they must file a defence within 21 days of the summons answering each allegation, and must carry out an enforcement notice's directions (rectify, suspend, erase or destroy data) within the time set and report on implementation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.