A controller must provide an effective way to revoke consent that is at least as easy as the way consent was given, and on revocation must stop the processing as soon as practicable and no later than 45 days after receiving the request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.