The controller must make generally available its identity and contact details, the DPO's contact details, its processing purposes, the rights of access, rectification, erasure and restriction, the right to complain to the controller (from 19 June 2026) and the right to complain to the Commissioner with its contact details. In specific cases it must also give the legal basis, retention period or criteria, recipient categories and anything further needed for the data subject to exercise rights (for example where data were collected without their knowledge). It may restrict the specific-case information where necessary and proportionate to avoid obstructing inquiries, prejudicing crime prevention or prosecution, protecting public security or protecting others' rights, and must then tell the data subject in writing of the restriction, reasons and their rights (unless that undermines the restriction), record the reasons and give the record to the Commissioner on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.