The controller must give Article 14 and 15 information and every communication under Articles 16 to 23 and 35 concisely, transparently, intelligibly and in clear, plain language (especially for children), in writing or electronically, or orally on request once identity is proven, and must facilitate the exercise of rights. It must act on a request without undue delay and within one month, extendable by two further months for complex or numerous requests with notice and reasons within the first month; reply electronically to electronic requests where possible; and, if it does not act, give reasons within one month and inform the data subject of the right to complain to the Agency and to seek judicial protection. Information and actions are free, but for manifestly unfounded or excessive requests the controller may charge a reasonable fee or refuse, bearing the burden of proof; it may ask for additional information where it has reasonable doubts about identity. Standardised machine-readable icons may be used.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.