Where the law requires authorisation (sensitive data, video surveillance, transfers abroad and other listed cases), the request must give the controller's identity, the data subjects, purposes, categories, place and date of processing, the data and their origin, who may access them, recipients, storage place and duration, confidentiality and security measures, interconnected databases, an undertaking to comply and a statement that the art. 22 eligibility conditions are met; any change to these particulars needs a new authorisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.