A controller or processor may appoint as data protection officer either a person included in the Inspectorate's list of data protection officers (people who have passed the Inspectorate's qualification examination) or another person, provided the appointee meets the criteria of Article 37(5) GDPR (professional qualities, expert knowledge of data protection law and practice, ability to fulfil the Article 39 tasks). A data protection officer on the list must notify the Inspectorate in writing without delay of errors in, or changes to, the list entry about him or her.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.