Provide and operate channels for data subjects to exercise statutory rights under Sections 26-33. Section 26 right of access within 1 month extendable by 2 months for complex requests + free of charge first request per year. Section 27 right of rectification of inaccurate or incomplete data. Section 28 right of erasure (right to be forgotten) where data no longer necessary + consent withdrawn + objected + unlawful processing + legal obligation + child data collected with parental consent now adult. Section 29 right to restriction of processing during accuracy dispute or lawful-basis contestation. Section 30 right to be informed (transparency obligations). Section 31 right of data portability in structured commonly-used machine-readable format where based on consent or contract and processed automatically. Section 32 right to object including absolute right to object to direct marketing + right to object to profiling + qualified right for legitimate-interest processing. Section 33 right not to be subject to solely automated decision-making with legal or similarly significant effects including profiling + safeguards including human intervention. Section 25 children below 16 require parental consent for information society services. Subject rights complaint to Commissioner (Section 41) free of charge + appeal to ICT Appeal Tribunal + Supreme Court appeal on points of law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.