The organization must set out and document policies and procedures for dealing with valid requests from individuals, such as asking for a copy of their data or making a complaint, and must answer them within suitable, defined timescales. It should take account of jurisdictions that fix response times according to how complex and numerous requests are and require individuals to be told of any delay, with the applicable timescales stated in the privacy policy, and of jurisdictions that allow a fee in limited situations, such as requests that are excessive or repeated.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.