The organisation publishes clear and easily accessible privacy statements, easy to find, applying to personal information collected online and offline, consistent with the Global CBPR Framework principles and dated with an effective date; the statement describes what personal information is collected and from which sources (6.a), the purposes (6.b), whether and to which third parties or categories it is made available and why (6.c), the organisation's name, address and a working e-mail address (6.d), how the information is used and disclosed (6.e), and how individuals can access and correct it with typical response times (6.f), unless a listed qualification is justified. Requirement 1 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.