Controllers of sensitive or health data must take appropriate measures for entry control to installations, control of data media, input control, control of use of automated systems by unauthorised persons through transmission facilities, access control limited to authorised persons, transmission control verifying the entities to which data may be sent, a posteriori verification of what data was entered, when and by whom, and transport control preventing reading, copying, alteration or deletion in transit or during carriage of media. The CNDP may exempt from some measures depending on the controller and installation, provided rights are safeguarded.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.