The data subject or a representative may at any time request access, rectification, erasure, objection and portability; exercising one right is neither a prerequisite for nor a bar to another. The controller must provide simple, prompt, accessible and free means, and the request must be answered within thirty calendar days (shorter if the regulations so provide); otherwise the data subject may go to the supervisory authority or file habeas data, but not both. The rights cannot be waived; charging a fee for them is a serious offence (45(25)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.