The data subject may request access to and a copy of personal data about them held under the controller's responsibility, or disclosure of how data was obtained without their consent. The controller must comply, and may refuse only where permitted by law or a court order and where access would adversely affect others' rights and freedoms; refusals and reasons are recorded under section 39. Requests that cannot be refused must be fulfilled without delay and within thirty days of receipt. The Committee may set rules on access, including extending the period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.