The data subject may object at any time, on grounds relating to their situation, to processing based on a public task, a recognised legitimate interest or legitimate interests, including profiling; the controller must stop unless it shows compelling legitimate grounds overriding the data subject's interests or needs the data for legal claims. Objection to direct marketing, including related profiling, is absolute and processing for that purpose must stop. The right must be brought explicitly to the data subject's attention, clearly and separately, at the latest at the first communication; it may be exercised by automated means for information society services; and it applies to research and statistics unless the processing is necessary for a public-interest task.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.