Article 21: the controller gives the Article 23 and 24 information and communications on rights concisely, transparently and in plain language (especially for minors), in writing or electronically, orally if identity is established; it assists data subjects; it acts on requests without delay and at the latest within 30 days, extendable by 60 days for complexity or volume with notice within the first 30 days; if it does not act it explains why within 30 days and mentions the complaint to the Commissioner and court action; responses are free unless requests are manifestly unfounded or excessive (burden of proof on the controller), when it may charge necessary costs or refuse; it may ask for identity confirmation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.