The processor must keep a special record of personal data processed for the controller, with the controller's, processor's and DPO's details, the categories of personal data, persons authorised to access it, processing times, restrictions and scope, the erasure, modification or processing mechanism, the purpose, cross-border movement and processing, and the security and processing measures; it must give the record to the Office on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.