Controllers must respond to data subject rights requests under the GDPR within one month, extendable by two further months for complex requests, with the data subject notified of the extension and reasons. Refusals must be communicated and include the right to lodge a complaint with ANSPDCP.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.