A legal person seeking a controller or processor licence or permit states its mechanism for obtaining consent and for exercising data subject rights; proves that it keeps the electronic records the obligations require; specifies its security mechanisms against the Centre's standards; proves its commitment to the Law and the licence terms and enables inspection; submits its contract with the DPO showing the officer's explicit acceptance of the responsibilities and the entity's commitment to the officer's independence; acknowledges the financial penalties the Centre may impose; and proves compliance with the sensitive and children's data controls; a natural person seeking a permit meets the same requirements other than the DPO contract and the penalty acknowledgment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.