GDPR Articles 13 to 15 do not cover information the controller may not disclose to the data subject under law or a decision made under law; for controllers that are not authorities the exception also covers information that would be confidential at an authority under the Public Access to Information and Secrecy Act. The government may issue further restrictions under GDPR Articles 23, 89(2) and 89(3).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.