Wherever special categories are processed under Article 22, the controller takes appropriate and specific measures suited to the state of the art, cost and risk, which may include technical and organisational measures for GDPR compliance, logging that shows whether and by whom data were entered, changed or removed, staff awareness, access restrictions, pseudonymisation, encryption, confidentiality, integrity, availability and resilience with rapid restoration, regular testing of measures, specific rules for transfers or further processing, and designation of a DPO.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.