Per RA 10173 Section 16 + NPC Circulars: data subject rights + notice + marketing. Requirements include (a) implement Data Subject Rights including Right to be Informed + Access + Object + Rectify + Erasure + Block + Data Portability + Damages + (b) provide Privacy Notices and Transparency including identity of controller + purposes + recipients + retention + rights + transfer + (c) implement Direct Marketing Restrictions including consent + opt-out + suppression lists + (d) implement Cookies and Online Tracking notice and consent + (e) maintain mechanism for rights handling within statutory timelines + (f) maintain records of requests + responses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.