The controller must give information and communications concisely, intelligibly and in clear language, in general in the same form as the request, facilitate the rights, reply in writing without undue delay, act free of charge (with a fee or refusal only for manifestly unfounded or excessive requests, bearing the burden of proof), and may seek identity confirmation. Where it restricts replies, it must tell the data subject that they may ask the Commissioner to verify lawfulness and may exercise their rights through the Commissioner. It must make available at least its identity and contacts and the DPO's, the purposes, the legal basis, and the rights of access, rectification, erasure and restriction and to complain to the Commissioner with its contacts; in specific cases also the storage period, recipients including abroad and further information, especially where data were collected without the data subject's knowledge. Information may be delayed, limited or refused while necessary and proportionate to avoid prejudicing investigations or proceedings or to protect public or national security or others' rights.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.