Processing PII entails a duty of care: document every policy, procedure and practice that concerns privacy and make them known; assign implementation to a specified individual who may delegate; bind third-party recipients to an equivalent level of protection by contract or mandatory internal policies; train personnel with access to PII; set up internal complaint handling and redress procedures; inform principals of any breach able to cause them substantial damage and of the measures taken, unless prohibited; notify the relevant stakeholders and authorities of breaches as jurisdictions require, depending on risk; give aggrieved principals access to effective sanctions and remedies, for example correcting or erasing the data, or restitution; consider compensation where privacy status cannot be restored; remediate breaches proportionately and as quickly as possible.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.