On request and free of charge, the data subject may obtain: the types of their personal data processed; the purposes; decisions based on automated processing, including profiling; the sectors or establishments inside and outside the State with which the data will be shared; the controls and criteria for storage periods; the procedures for correction, erasure, restriction and objection; the protection measures for cross-border processing under Articles 22 and 23; the actions taken on a breach or misuse, especially one that directly and seriously threatens privacy; and how to complain to the Office. The controller may refuse only where the request is unrelated to these items or excessively repetitive, conflicts with judicial procedures or investigations, may harm its information security efforts, or affects third parties' privacy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.