The controller need not give information or access covered by legal professional privilege (or confidentiality of communications in Scotland) or a legal adviser's duty of confidentiality, but when it relies on this it must tell the data subject in writing without undue delay of the decision, the reason (unless that would undermine the claim or duty) and their rights to ask the Commissioner to check, complain to the controller and the Commissioner and apply to court, record the reason, and give the record to the Commissioner on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.