Articles 23 and 24: when collecting from the person the controller states its identity and contact details, the DPO's contacts, purposes and legal basis, legitimate interests pursued, recipients, intended transfers and safeguards, retention period or criteria, the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent, the right to complain to the Commissioner, whether provision is required and the consequences, and any automated decision-making with meaningful information on logic and consequences; for data obtained elsewhere it adds the categories and source and provides it within a reasonable time and at the latest within 30 days, at first communication or disclosure; new purposes require prior information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.