At any time the individual may access and apply to review their personal data held by any controller and in particular has the right to be notified of the processing of their personal data and its purposes, to be notified of any disclosure of inaccurate personal data, and to obtain a copy of their personal data for a charge not exceeding the service cost; articles 20 and 21 limit the duty where disclosure would defeat an article 18 purpose, harm another individual's commercial interests or disclose another individual's data without consent with a risk of damage. The guideline's 30-calendar-day response applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.