At the time personal information is collected, directly or through third parties acting for the organisation, individuals are told that it is being collected (or, where not practicable, that it has been), and the notice is reasonably available, unless a listed qualification is justified. Requirement 2 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.