Where a controller, processor or holder is requested to disclose personal data it must follow set procedures: the request must be written and submitted by the relevant person or under a legal deed; the required documents granting access must be verified and retained; and the disclosure decision with supporting documents must be made within six working days of submission, with rejection reasons stated. Lapse of the period without a decision is deemed a rejection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.