Provide privacy notice + honor data subject rights per Oman PDPL Articles 11-18. Notice must (a) be provided at collection covering identity of controller + purpose + lawful basis + retention + recipients + cross-border transfers + data subject rights + complaint mechanism per Article 11, (b) be in plain Arabic and English where applicable + accessible to vulnerable populations + (c) be updated when material changes occur. Data subject rights include (a) access per Article 13, (b) rectification per Article 14, (c) erasure per Article 15, (d) restriction per Article 16, (e) objection per Article 17, (f) portability per Article 18, (g) right not to be subject to automated decision-making per Article 19. Handle rights requests within statutory timeframes (typically 30 days extendable + free of charge with exceptions) + maintain audit trail.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.