A request to a person for personal information to be processed in a database must be accompanied by a notice stating whether the person is legally obliged to provide it or does so by choice and the consequences of not consenting; the purpose; the controller's name and contact details; to whom the information will be given and for what purposes; and the rights of access (section 13) and correction (section 14). Sanctions scale with the number of persons approached (section 23KF(c)); misleading details are an offence (23NF).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.