The public body involves the officer properly and early in every data protection matter, provides the resources, access to data and processing operations and training the tasks require, and ensures the officer takes no instructions on the tasks, reports directly to top management and is not dismissed or penalised for performing them. Removal as officer is possible only on the terms of Civil Code s 626 (important reason); the officer's employment may be ended only for cause justifying termination without notice, during the appointment and for a year after it. Data subjects may approach the officer on any issue; the officer keeps their identity confidential unless released, and shares the body's right to refuse to testify, with seizure protection for the officer's files. Through s 38(2) the confidentiality and testimony rules, and where designation is mandatory the dismissal protection, also bind private bodies.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.