On written or electronic request the controller or processor must provide the data subject with information on the purposes of processing, a copy of their personal data, a description of the data held including the contact details of third parties or categories of third parties that have or had access, the source of the data where not obtained from the data subject, and whether the data has been transferred to a third country or international organisation; the copy may be withheld where it would adversely affect others' rights and freedoms, where legal professional privilege or another confidentiality obligation applies, where the data relates to information management or ongoing negotiations with the requester, or where it concerns confidential references, examination scripts or marks; the data must be provided clearly and concisely; the data subject may appeal to the supervisory authority within 30 days of the response and the authority responds within 60 days.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.