The organization must keep a record of personal data it sends to, or receives from, third parties, and must work with those parties so that later requests linked to its obligations to individuals can be handled. This covers data returned by third parties after being changed as controllers meet their obligations, and data sent to third parties to carry out valid individual requests, such as deletion after consent is withdrawn. The organization must have a policy setting how long these records are kept, and must minimise their content so that only what is strictly necessary is held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.