Employees' data may be processed to uncover criminal offences only where documented factual indications support a suspicion that the person committed an offence in the employment relationship, the processing is necessary to uncover it, and the employee's legitimate interest in exclusion does not prevail, in particular because the kind and extent of the measure are not disproportionate to the occasion. The rule governs covert measures such as hidden cameras, keystroke logging or targeted mailbox review in an internal investigation: blanket or suspicion-free covert monitoring does not meet it.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.