The controller must make the notice available in printed, digital, visual, audio or other formats: at the time of collection for data obtained in person on printed forms (unless given before), and for data obtained electronically, optically, by sound, visually or by other technology through a simplified notice with at least the identity, data, purposes and options (article 15 I to IV) and where to consult the full notice. Where data were not obtained directly from the data subject, the controller must make the change in the privacy notice known to the person, except for historical, statistical or scientific purposes; where direct notice is impossible or disproportionate it may use compensatory measures under the Reglamento.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.