On proof of identity (national ID or alien ID card, passport or travel document, or driving licence) and a request in Form 8, the controller confirms whether it holds the person's data, describes it and identifies third parties with access, decides within seven days and complies within thirty days, gives reasons for any refusal, and protects other individuals' data by consent, reasonableness or redaction rather than refusing the whole request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.