Per POPIA Sections 23-25 + 71: data subject rights. Requirements include (a) implement Access to Personal Information (Section 23) - data subjects have right to be informed of processing + obtain copy of records + (b) implement Correction of Personal Information (Section 24) - data subjects can request correction or deletion + (c) implement Automated Decision Making (Section 71) protections - data subjects cannot be subject to a decision based solely on automated processing that has significant effects + (d) implement Right to Object (Section 11 + 69) including for direct marketing + (e) maintain mechanism for receiving + verifying + responding to requests within statutory timelines + (f) maintain records of requests + responses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.