A controller must provide a reasonably accessible, clear and meaningful privacy notice stating the categories of personal data processed, the purposes, the categories of data sold to or shared with third parties, the categories of those third parties, an active e-mail address or other contact mechanism, an explanation of the rights in 30-14-2808(1) and how to exercise and appeal them, and the date the notice was last updated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.