The processor holds its licence or permit; operates a Centre-approved mechanism that sets the volume of data and the purpose of processing, records the data subject's consent and shows notification of the processing period to the controller, the data subject and interested parties; binds its data handlers to confidentiality; gives the Centre's inspectors access and keeps processing purposes within the licensed activity; if outside Egypt without a branch, appoints an accredited representative or, as a natural person, an agent; processes for no purpose other than the controller's except non-profit statistical or educational work with the data subject's consent, a relevant subject and encoding that prevents identification; handles data used to train artificial intelligence and emerging technologies under locally, regionally and internationally recognised principles so that no harm results to the data subject; obtains only the volume and type of data its activity's law allows; secures data during processing including devices and media and stores it in unreadable form so that unauthorised persons cannot link it to the data subject; keeps recovery and access measures; and keeps secure electronic processing records describing the processing operations and the categories and scope of data used, with the processor's details, a copy of the processing contract with the controller, the controller's DPO and legal representative, the processing standards and, for cross-border transfer, the countries, security systems, data route and technical standards, the processing periods per category, the security procedures, and the date and time of erasure or proof of delivery to the controller.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.