On a written request with sufficient detail, sent to the Quality Service Manager or another acceptable channel, the agency must provide as soon as reasonably possible the personal data the individual provided and how it was used or disclosed in the previous 12 months, by copy, inspection or another acceptable form, and if it cannot within 30 days inform the individual in writing when it will respond; it must withhold data under the Annex C exceptions and where disclosure could threaten others' safety or health, cause grave harm to the requester, reveal another person's data or a source's identity, or be against the national interest, must not reveal disclosures to law enforcement made without consent under written law, must provide what can be separated, and must notify rejections and exclusions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.