A data subject may obtain confirmation whether their data are processed and, if so, access to the data and to the purposes, categories, recipients (especially abroad), retention period or criteria, the rights to rectification, erasure, restriction and objection, the right to complain to the controller and to the Commissioner, the source, and the existence of automated decision-making with Article 22C safeguards and meaningful information about it. The data subject is entitled only to what the controller can provide after a reasonable and proportionate search (Article 15(1A), in effect from 1 January 2024 by the Act's retrospective provision). Where data go abroad under Article 46 safeguards the data subject may be told of them. The controller must provide a copy, may charge a reasonable fee for further copies, gives the copy electronically for electronic requests, and must not adversely affect the rights of others.
This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.