In answering an Article 15 GDPR access request a controller must withhold information whose disclosure is prohibited by the laws on national security, national protection, public safety and criminal law, or for public financial interests in tax protection, prevention of money laundering and terrorist financing, supervision of financial market participants and their guarantee schemes, regulation and macroeconomic analysis. The response may not refer to public institutions that are persons directing criminal proceedings or bodies performing operational activities, or to other institutions whose disclosure is prohibited by law. Information on the recipients or categories of recipients to whom the data subject's data were disclosed covers the last two years.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.