The Controller responds to data subject requests about their rights within the period and manner the Regulations set (Law 21): it acts within 30 days without delay, extendable by at most 30 more days where the request needs disproportionate effort or there are multiple requests, with advance notice and reasons; takes technical, administrative and organisational measures for prompt responses; verifies the requester's identity; documents all requests, oral ones included; may refuse repetitive, manifestly unfounded or disproportionate requests with reasons given; lets legal guardians act for those lacking capacity (IR 3); and offers channels such as email, text message, the national address, electronic applications or other means (IR 10).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.