The GDPR Art. 14 information duty does not apply as far as meeting it would disclose information that is confidential by its nature, especially because a third party's interests prevail; access under Art. 15 is excluded as far as it would disclose information confidential by law or by nature; and breach communication under Art. 34 is excluded on the same grounds, except that the data subject must be told where their interests outweigh secrecy, especially given the threat of damage. Where a client passes third parties' data to a lawyer or other professional bound by secrecy, the client need not inform those persons under Art. 13(3) unless their interest in being informed prevails. The investigative powers of the supervisory authorities are limited toward professional secrecy holders.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.