A controller or processor (or UK representative) must comply with an information notice requiring information, and since 19 August 2025 documents (DUAA s. 97), that the Commissioner reasonably requires, in the form, place and time specified, after the appeal period unless the notice is urgent (not less than 24 hours). Privileged legal advice, parliamentary privilege and self-incriminating information outside the Act's offences are excluded. The court may make an information order on non-compliance. It is an offence to make a knowingly or recklessly false statement in response, and, once given an information or assessment notice, to destroy, dispose of, conceal, block or falsify information, documents, equipment or material to prevent the Commissioner seeing it. Notices may be served by hand, at the proper address, by post or by email (section 141A, DUAA s. 96).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.