Where the organisation discloses personal information to recipients where due diligence and reasonable steps to ensure their compliance are impractical or impossible, it explains why and what other means (such as the individual's consent, whose nature and collection it explains) protect the information consistently with the principles. Requirement 50 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.