On request the controller tells the data subject what data are processed and their categories, their origin, purposes and legal basis, recipients (notably in third countries), retention, the rights to rectification, erasure and restriction, the right to complain and the Authority's contacts; it may refuse or restrict where Article 54(2) grounds apply, informing the data subject in writing without delay with reasons unless that defeats the purpose, and of the possibility of exercising access through the Authority; it documents the reasons and transmits the decision to the Authority unless national security is invoked. Communications are concise, clear and in the form of the request, free of charge except for manifestly unfounded or abusive requests, and identity may be checked where doubtful.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.