On request an organisation must, as soon as reasonably possible (the regulations and guidelines set 30 days, with notice of any longer time), provide the individual with their personal data in its possession or control and information about the ways the data has been or may have been used or disclosed within the year before the request; it need not provide matters in the Fifth Schedule (opinions, examination scripts, investigation and legal-privilege data, data prohibited by law) and must not provide data that could threaten another's safety or health, cause immediate or grave harm to the requester, reveal personal data of another individual (except user activity or user-provided data of the requester), reveal the identity of a non-consenting provider, or be contrary to the national interest; must not reveal disclosures to a prescribed law enforcement agency; must give what can be given with the excluded parts removed; and, since 2020, must notify the individual of a rejection within the prescribed time and of any exclusions applied.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.