When collecting directly, the Controller informs the data subject of the legal basis; the purpose, which data is mandatory or optional and that it will not later be processed inconsistently with the purpose except under Law 10; unless for security purposes, the identity of the collector and its representative's address; recipients, their capacity and any transfer, disclosure or processing outside the Kingdom; the consequences of not providing the data; the data subject's rights; and other elements the Regulations set (Law 13). The Regulation adds the Controller's contact channels, the DPO's contact details, the retention period or criteria, how to withdraw consent, and, for large-scale processing of those lacking capacity, continuous monitoring, new technologies or automated decisions, the means of collecting sensitive data, protective measures and whether decisions are solely automated; notice is given before further processing, in appropriate language for those lacking capacity, and within 30 days where data is collected from someone other than the data subject (with stated exceptions) (IR 4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.