A controller must, on an authenticated request, confirm whether it processes the consumer's personal data and give access to it, subject to the copy or summary limits of subdivision (4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.