At collection the controller must give its identity and contact details (and its representative's), the DPO's contact details, the purposes and legal basis, the legitimate interests pursued, the recipients, and any intended transfer abroad with the existence of an adequacy decision or the safeguards relied on; and, for fair and transparent processing, the retention period or criteria, the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent, the right to complain to the Agency, whether providing data is a statutory or contractual requirement and the consequences of not providing it, and the existence of automated decision-making with meaningful information about the logic and consequences. Further processing for a new purpose requires prior information about it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.