A notification must be sent once before processing begins, stating the processing purposes, the categories of personal data used for those purposes, the means of processing, the other organizations or individuals related to the purposes, the unexpected consequences and damages likely to occur, and the start and end time of processing, in a printable, reproducible or verifiable format; notification is not required where the data subject already knows and fully agrees to those contents before consenting to collection, or where a competent state agency processes data to serve its operation under law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.