Responsibility and compliance. Section 5 requires every organisation to adopt suitable measures and policies to give effect to its obligations, remain responsible for personal information transferred to others, and designate a representative (privacy officer) for compliance (s5(4)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.