The Commissioner may require a person to take or refrain from specified steps where it has failed the principles, data subject rights (Articles 12 to 22D, Parts 3 and 4), controller and processor duties (Articles 25 to 39, sections 64 and 65), breach communication, the transfer rules, monitoring body or certification duties, the charge regulations, or since 19 June 2026 the complaint-handling duty in section 164A. A notice may ban all or specified processing, require rectification or erasure of inaccurate data and opinions based on it and notification of third parties, and applies after the appeal period unless urgent (24 hours). Non-compliance can attract the higher maximum penalty. A person may apply for variation on a change of circumstances.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.