When collecting directly from a data subject the controller must, at the time of collection, inform the person of the controller's identity and contact details (and any representative and data protection officer), the purpose, the intended recipients, whether supply is voluntary or mandatory, the right to withdraw consent, the rights of access, rectification, restriction, erasure and objection, any automated decision making or profiling with its logic, significance and consequences, the storage period, the right to complain to the Commissioner, any intended transfer abroad and the protection level there, and any further information needed for fair processing. Where data are collected indirectly the controller must ensure the person is informed of the same matters, unless the person already has the information, informing would be impossible or disproportionate, or recording or disclosure is laid down by law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.