The controller uses only processors that guarantee lawful processing through appropriate measures, under a written or electronic contract setting subject, duration, nature, purpose, data categories and rights and obligations, requiring the processor to act only on instructions (flagging unlawful ones), bind its staff to confidentiality, assist with data subject rights, return or delete data at the end, provide compliance information including logs, allow audits, apply Article 62 security and assist with Articles 62 to 65 and 67; sub-processors need prior written authorisation and the same obligations. Joint controllers set out their responsibilities in a written arrangement naming who handles information duties and where data subjects exercise rights.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.