Under the standard clauses the parties choose (Clause 4) either Option A, where at least one party is a controller and a designated controller party publishes the transparency document, answers data subject requests and communicates security incidents (the controller remains responsible if the designated party turns out to be a processor), or Option B for processor-to-processor transfers on the written instructions of an identified third-party controller, with the exporter jointly liable if it departs from those instructions. The parties must: use the data only for the purposes described; limit processing to the minimum; give data subjects clear information and free consultation and keep data accurate; apply security measures suited to the risks; not process for unlawful discrimination; bind anyone acting under their authority, including sub-processors; keep a record of processing and present it to the ANPD; apply additional safeguards for sensitive data and for children's and adolescents' data (in their best interest); and the exporter warrants the data were collected lawfully. The designated party publishes a Portuguese transparency document, supplies a free copy of the clauses, answers the listed data subject rights (including review of automated decisions) within 15 days, and communicates incidents with relevant risk to the ANPD and data subjects within three business days, while the importer keeps an incident register. Each party that causes damage in breach must repair it, processors and involved controllers are jointly liable, and the burden of proof may be reversed in the data subject's favour.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.