Articles 29 to 31, 33 and 34: data subjects may have inaccurate data rectified and incomplete data completed without delay; they may obtain erasure where data are no longer needed, consent is withdrawn and no other basis exists, they object without overriding grounds or to direct marketing, processing was unlawful, a legal duty requires it, or data were collected from a minor for information society services, and a controller that made the data public takes reasonable steps to inform other controllers; exceptions cover freedom of expression, legal obligations, public health, archiving and research, and legal claims; restriction applies while accuracy or an objection is checked, for unlawful processing where the person prefers restriction, or where the person needs the data for legal claims; recipients are told of rectification, erasure or restriction, and refusals are explained.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.