A data subject may obtain confirmation whether their data are processed, access to the data and the purposes and legal basis, categories, recipients (including abroad), retention period or criteria, the rights to rectification, erasure and restriction, the rights to complain to the controller and the Commissioner, and any available information on origin, limited to what a reasonable and proportionate search can find (in effect from 1 January 2024). The answer must be in writing without undue delay and within the applicable time period. The controller may restrict access where necessary and proportionate to avoid obstructing inquiries, prejudicing crime prevention or prosecution, protecting public security or protecting others' rights, must then inform the data subject in writing of the restriction, reasons and their rights to ask the Commissioner to check, complain to the controller and to the Commissioner and apply to court, and must record its reasons.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.