Where processing rests on a task in the public interest or official authority (GDPR art. 6(1)(e) and 6(3)(b)), the legal basis must be a provision of law, a regulation or a general administrative act (the latter added in 2021). Public administrations under D.Lgs. 165/2001 art. 1(2), independent authorities, bodies on the ISTAT list and State-controlled companies (local ones only as public service operators, and not for free-market activities) may also process where necessary for a public-interest task or public powers assigned to them, always respecting GDPR art. 6 so that the rights of data subjects suffer no actual and concrete prejudice.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.