A written decision on a request under GDPR arts 15 to 22 is taken within the periods of GDPR art. 12(3) (one month, extendable by two months); a decision by an administrative body is a decision (besluit) under the General Administrative Law Act, open to objection and appeal. Against a private controller the data subject may petition the district court within six weeks of the answer, or at any time if there was no answer in time, without a lawyer, and the controller must provide the information and documents the court asks for (art. 35).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.