Whenever a controller, processor or holder is asked to disclose personal data, the request must be in writing from the relevant person or under a legal deed, the recipient verifies and retains the documents required to grant access, and it decides, with reasons for any refusal, within six working days of submission; silence beyond that period is a refusal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.