On a data subject's written request the controller must, at reasonable intervals, without excessive delay and free of charge, confirm whether personal data about the person are processed and send a copy, together with the purposes, categories, recipients, storage period or its criteria, the rights of rectification, erasure, restriction and objection, the right to complain, the source where not collected from the person, any automated decision making and its logic and consequences, and the section 36 safeguards for transfers, in intelligible, clear and plain language. The controller may ask for information to confirm identity, must inform the person in writing within one month whether action was taken (extendable by a further month for complexity or volume) and give reasons for any refusal and the possibility of complaint within one month; for manifestly excessive requests it may charge the prescribed fee (Rs 100) or refuse, bearing the burden of proof.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.