Controllers must give data subjects, in writing or electronically and in concise, transparent, intelligible and accessible form, the Schedule V information and information about any decision on a Part II request. When collecting from the data subject this means: controller and representative identity and contacts, DPO contact, purposes and legal basis, any legitimate interest relied on, data categories, the right to withdraw consent, recipients, planned cross-border transfers, retention period or criteria, data subject rights, the right to complain to the Authority, whether provision is statutory or contractual and the consequences of not providing it, and automated decision-making or profiling with meaningful information on its logic and consequences; new purposes need fresh notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.