The organisation has written policies and procedures ensuring that personal information collected directly or through an agent is used only for the purposes identified in the privacy statement in force at collection or for compatible or related purposes. Requirement 8 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.