In addition to GDPR Art. 37(1)(b) and (c), controllers and processors must designate a data protection officer where they as a rule constantly employ at least 20 persons in the automated processing of personal data, and regardless of headcount where they carry out processing requiring a data protection impact assessment under GDPR Art. 35 (for example systematic employee monitoring) or process data commercially for transfer, anonymised transfer or market or opinion research. Section 6(4) (dismissal protection, only where designation is mandatory), 6(5) sentence 2 (confidentiality) and 6(6) (right to refuse testimony) apply.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.