A controller must delete personal data provided by the consumer or obtained about them from any source, on an authenticated request, unless an exemption in chapter 7 or 8 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.