The controller must inform data subjects, through the privacy notice, of the existence and main characteristics of the processing so they can make informed decisions. The notice contains at least the controller's identity and address; the personal data processed, identifying the sensitive data; the purposes, distinguishing those that require consent; the options and means offered to limit use or disclosure; the mechanisms, means and procedures to exercise the ARCO rights; and the procedure and means by which changes to the notice will be communicated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.