A data subject may obtain from a controller, without constraint or unreasonable delay, confirmation whether the controller or a processor on its behalf is storing or processing personal data about them and, if so, the purposes, the categories of data, the recipients or categories of recipients particularly in third countries or international organisations, the storage period or its criteria, the existence of the rights to rectification, erasure, restriction and objection, the right to complain to the Commission, the source where the data was not collected from the data subject, and the existence and significance of automated decision-making including profiling; a copy in a commonly used electronic format (the data subject may be asked to bear unreasonable costs); correction or, where correction is not feasible or suitable, deletion of inaccurate, out of date, incomplete or misleading data; erasure without undue delay; and restriction of processing pending the resolution of a request, an objection, or legal claims. The controller erases personal data without undue delay where it is no longer necessary for the purposes or the controller has no other lawful basis to retain it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.