The organisation provides individuals access to their personal information through reasonable mechanisms: it confirms identity (44.a), responds within a reasonable time (44.b), communicates in a legible, generally understandable way (44.c) compatible with its usual interaction with the individual such as the same language or e-mail (44.d), and any fee is not excessive (44.e); a denial is explained with contact details for challenging it. Requirement 37 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.