Any person served with a Commission information notice must provide the requested information on processing, security and section 41 documentation within the timeframe (secrecy laws do not excuse it, subject to national security and Part V exceptions), and must not give false or misleading information. Controllers and processors are notified before investigations and must comply with enforcement notices (which may require correction, destruction or cessation of processing) within the stated time, may give enforceable undertakings, and must not obstruct officers executing a warrant. Contraventions attract court pecuniary penalties up to $30,000 for a first and $100,000 for a later contravention by an organisation or public authority, and data subjects may sue for loss. Decisions on notices may be reconsidered within 10 business days or judicially reviewed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.