The organization shall name a contact for customers on matters of PII processing and, where it acts as a PII controller, a contact for PII principals on how their own PII is processed. It shall also give one or more people the job of building, running, keeping up and overseeing a privacy and governance programme across the whole organization that secures conformance with the laws and regulations governing PII processing. Where appropriate, that person shall: be independent and answer directly to the right level of management; take part in handling every matter concerning PII processing; have expert knowledge of data protection law, regulation and practice; serve as the contact for supervisory authorities; brief top management and staff on their duties; and give advice on privacy impact assessments. Some jurisdictions name this role the data protection officer and specify when one must be appointed; it may be filled internally or outsourced.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.