The processor processes personal data under the Law and its Regulations, in the legitimate cases and on the written instructions of the Centre, the controller or the relevant person, in particular on the scope, subject and nature of processing and the type of data and its conformity and sufficiency with the purpose; ensures the purpose and its practice are legitimate and do not violate public order or morals; does not exceed the purpose or period of processing and notifies the controller, the data subject or the relevant person of the period needed; deletes the data or delivers it to the controller when the period lapses; and neither acts nor omits to act so that data or processing results are disclosed except as the law permits.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.