Requests for access state the requester, the subject, the database or controller, the data sought and the purpose or legal ground; the controller decides within ten working days and tells the requester whether it will be satisfied, fulfils it within thirty calendar days, never defers a subject's access to their own data, may defer third-party access with written notice (total no more than forty-five days), refuses only where law prohibits access with a written notice of the official, date and reason, and gives subjects access to their own data free of charge; subjects' appeals go to the Commissioner or court with the burden on the controller to justify refusal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.