On request a controller must delete personal data concerning the consumer (removing it so it is not maintained in human- or machine-readable form and cannot be retrieved in the ordinary course of business). For data obtained from a source other than the consumer, the controller may comply by keeping a record of the request and the minimum data needed to keep the consumer's data deleted, used for no other purpose, or by opting the consumer out of processing for any non-exempt purpose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.