On request a controller must delete personal data about the consumer, whether collected from the consumer or elsewhere. For data obtained from a source other than the consumer, the controller is treated as compliant if it keeps a record of the request and the minimum data needed to ensure the data stays deleted and uses that retained data for nothing else, or if it opts the consumer out of all processing except processing the Act exempts.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.