Requests contain the data subject's name and address or other means of notification, identity documents (or the representative's), a clear description of the data (except for access), the right exercised and anything helping to locate the data. The controller communicates its determination within at most 20 business days of receipt and, if the request succeeds, makes it effective within the next 15 business days; each period may be extended once by an equal period when circumstances justify it. Access is given after identity is verified, by making the data available or through copies, electronic documents or other means set in the notice. Requests may be refused, wholly or partly, only where the requester is not properly accredited, the controller does not hold the data, third parties' rights would be harmed, a legal impediment or authority resolution prevents it, or the action was already taken; the controller must give reasons, by the same means as the request, with any evidence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.