Subjects may learn whether their data is held and obtain confirmation of processing, grounds and purposes, methods, the owner's and operator's identity and address and who can access the data, the data held and its source, processing and storage periods, how to exercise rights and any cross-border transfer. Limited exceptions apply (prior notice given, public data, harm to others' rights). A refusal must reach the subject in writing within ten days and can be appealed to the authorised body or a court.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.