A processor must follow the controller's instructions and help it meet its duties, including by assisting with consumer requests through appropriate technical and organisational measures, with security of processing and breach notification under s. 501.171, and by supplying information for data protection assessments. Whether a person is a controller or processor is fact-based; a processor that keeps following instructions remains a processor.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.