The data subject has the rights to be informed, to consent or refuse except in the article 17 cases, to access personal data to view, rectify or request rectification, to withdraw consent, to erase or request erasure, to request restriction of processing (which the controller must carry out within 72 hours of the request for all data covered by the request), to be provided with their personal data, to object to processing aimed at preventing or limiting disclosure or use for advertising or marketing (acted on within 72 hours of the request), to complain, denounce and sue, to claim compensation for damage, and to self-defence under the Civil Code; the controller must ensure these rights (article 38.5).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.