A controller must provide one or more secure and reliable means to submit requests suited to how consumers interact with it, may not require a new account (an existing one may be used), must inform the consumer of action taken within 45 days (extendable once by 45 days with notice and reasons within the first 45), and if it does not act must give reasons and appeal instructions within 45 days. Information is free up to twice a year; for manifestly unfounded or excessive requests it may charge a reasonable fee or refuse, bearing the burden of proof. It need not comply with access, correction, deletion, portability or third-party-list requests it cannot authenticate with commercially reasonable effort and may ask for more information. It must never disclose Social Security, driver's licence or other government identification numbers, financial account, health insurance or medical identification numbers, passwords or security answers, or biometric data in a response, but must say it holds that type of information, and need not reveal trade secrets.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.