All other wholly or partly automated processing, or set of processing with the same or linked purposes, must be declared to the CNDP before it is implemented, the declaration containing an undertaking that processing will comply with the Law and stating the controller and representative, name, characteristics and purposes, categories of data subjects and data, recipients, planned transfers abroad, retention period, the office where rights may be exercised and the measures to facilitate them, a general description of confidentiality and security measures under Articles 23 and 24, and any cross-checking, interconnection, transfer or subcontracting to third parties. Every change and every deletion must be notified without delay, and a transferee of a file must itself declare. Declarations are filed by registered letter, by hand against receipt or electronically on the CNDP's model forms (Decree Articles 23 to 26). Operating a file without the required declaration or authorisation is an offence punishable by 10,000 to 100,000 dirhams (Article 52).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.