Controllers and processors keep logs in automated systems of at least collection, alteration, consultation, disclosure including transfers, combination and erasure; consultation and disclosure logs must show the justification, date and time and, as far as possible, who consulted or disclosed and the recipients. Only the data protection officer, the Commissioner and the data subject may use the logs, to check lawfulness, for self-monitoring, integrity and security, and for criminal proceedings; they are deleted when the year following their creation ends and made available to the Commissioner on request.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.