Those agreements generally require processors, agents and contractors to abide by the organisation's Global CBPR-compliant policies or implement substantially similar practices, follow its handling instructions, restrict subcontracting without its consent, be Global CBPR-certified in their jurisdiction where used, and notify the organisation of breaches of its customers' personal information. (Breach notice term added in the updated set.) Requirement 47 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.