Articles 11-16 establish the DATA SUBJECT RIGHTS regime. Each right is exercisable through a request to the controller + the controller must respond within reasonable time (Data Office guidance suggests 30 days). The 6 rights: (Art 11) RIGHT TO INFORMATION + transparency about processing (similar to GDPR Articles 13-14); (Art 12) RIGHT OF ACCESS - obtain confirmation + a copy of personal data being processed; (Art 13) RIGHT TO RECTIFICATION + correction of inaccurate personal data; (Art 14) RIGHT TO ERASURE (right to be forgotten) in specified circumstances - withdrawal of consent + processing unlawful + objection + data no longer necessary; (Art 15) RIGHT TO RESTRICT PROCESSING + RIGHT TO DATA PORTABILITY in machine-readable + interoperable format; (Art 16) RIGHT TO OBJECT TO PROCESSING (including direct marketing + processing based on legitimate interests) + RIGHT NOT TO BE SUBJECT TO AUTOMATED DECISION-MAKING that produces legal effects or similarly significantly affects the data subject. The rights can be restricted only on specified grounds (legal claims + public-interest research + statistical purposes + national security + compliance with another law).
This control maps to 88 controls across 42 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 88 it maps to, and the evidence behind each claim, over MCP and REST.