Every file, register or data bank, public or private, must have adequate information policies that guarantee security and control measures against improper handling of data subjects' information; private persons forming files that are not purely personal must meet the law's requirements (Article 41).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.