The declaration must state: the purposes of processing; the personal data processed and their source; the categories of data subjects; the third parties or categories who may receive the data; the retention period; the identity and address of the controller and, where the controller resides outside Lebanon, of its representative; the body or bodies carrying out the processing; the person or body with whom the right of access is exercised and how; any subcontractor; where relevant, interconnections with other processing and possible transfers of the data to others; where relevant, transfers of personal data to another state in any form; the measures taken to ensure the security of the data and protect legally protected secrets, which the controller must implement properly; and an assurance that processing will comply with the law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.