The data subject is entitled to sufficient, accessible, clear information on how their data are processed, whether provided directly or not, adapted to children, adolescents and persons with disabilities. At collection the controller must give at least: the categories of data; its identity and contact details (legal address, telephone and email or equivalent); the legal basis and purposes; intended international communications or transfers with recipients and purposes; how to exercise access, rectification, objection, erasure and portability; the retention period or its criteria; any automated decisions including profiling with meaningful information on the logic; the source when not collected from the data subject; and the right to complain to the supervisory authority. Information and actions are free; for manifestly unfounded or excessive requests the controller may charge a reasonable cost-based fee or refuse, bears the burden of proving that character, and must keep a detailed record of refused requests and reasons.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.