A DPO must be appointed by public-body controllers and holders of their databases (except security bodies), data broker controllers with more than 10,000 data subjects, controllers or holders whose core activities require regular and systematic monitoring of individuals on a significant scale (for example mobile operators and search providers), and controllers or holders whose core activities process information of special sensitivity on a significant scale (for example banks, insurers, general hospitals and health funds); scale weighs numbers, proportion of a population, volume and range of data, duration, frequency, retention and geography.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.