The data subject may have processing restricted while accuracy is contested, where processing is unlawful but they prefer restriction to erasure, where the controller no longer needs the data but the data subject needs them for legal claims, or pending verification of an objection. Restricted data may, apart from storage, be processed only with consent, for legal claims, to protect another person's rights, or for important public interest, and the data subject must be told before a restriction is lifted.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.