A controller must give consumers a reasonably accessible, clear and meaningful privacy notice that includes at least: (1) the categories of personal data it processes; (2) the purpose of processing; (3) the categories of all third parties to which it may disclose personal data; (4) the categories of personal data shared with third parties, if any; (5) how consumers exercise their rights, with the controller's contact information and how to appeal a decision on a request; (6) the process for notifying consumers of material changes to the notice, with the notice's effective date; and (7) an active email address or other online mechanism for contacting the controller.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.