The controller may use only processors giving sufficient guarantees of appropriate technical and organisational measures. Processing must be governed by a written contract, law or sub-legal act setting out subject matter, duration, nature and purpose, data types, categories of data subjects and the controller's rights and obligations, and binding the processor to act only on written instructions (including for transfers, unless law requires otherwise and it informs the controller); ensure confidentiality of authorised persons; take the Article 28 security measures; respect the sub-processor conditions; help the controller answer rights requests and meet Chapter III obligations, especially security and breach notification; delete or return all data at the end of the service as instructed; and provide all information needed to demonstrate compliance, allow audits and inspections, and immediately flag instructions that infringe the Law. Sub-processors need the controller's prior specific or general written authorisation (with notice of changes and a chance to object), carry the same obligations by contract, and the initial processor stays fully liable. The contract may use standard clauses published by the Commissioner. A processor that determines purposes and means becomes a controller for that processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.