Data subjects must be informed, loyally and transparently, of: purposes; legal basis; types of processing; retention period; the existence of the database; the source where data were not collected from them; other purposes and further processing; the controller's identity and contact details (legal address, telephone, email); where applicable the data protection officer's details; intended national or international transfers with recipients, their classes, purposes and safeguards; the consequences of providing or refusing data; the effect of wrong data; the possibility of withdrawing consent; how to exercise access, deletion, rectification and updating, objection, annulment, restriction and the right not to be subject to automated decisions; how to exercise portability; where and how to complain to the controller and the Authority; and the existence of automated assessments and decisions including profiling. Information is given at collection when data are obtained from the data subject; otherwise, or when data come from a public source, within 30 days or at the first communication, whichever comes first, in express, clear, concise language without technical barriers, preferably in the language the data subject chooses; for products or services aimed at or usable by children, to their legal representative.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.