Where an organisation refuses to provide access to personal data requested under section 21, it must preserve a complete and accurate copy of that personal data for not less than the prescribed period (30 calendar days after the rejection under the Regulations 2021, or until the individual has exhausted any right to apply for reconsideration or appeal), so that a review by the Commission can be given effect; the guidelines require organisations to identify and preserve requested data as soon as a request is received where scheduled disposal would otherwise delete it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.