Per Norwegian PDPA + GDPR Articles 12-22: data subject rights. Requirements include (a) implement Data Subject Rights including Access + Rectification + Erasure + Restriction + Object + Data Portability per GDPR + (b) implement Right to Object specifically for direct marketing + (c) implement Automated Decision Making protections including human review + meaningful information about logic + explanation + (d) maintain mechanism for receiving + verifying + responding within statutory timelines (typically 30 days extendable) + (e) maintain records of requests + responses + decisions + (f) integrate with broader privacy programme.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.