The simplified regime does not exempt small agents from the legal bases, principles, data subject rights or other rules. They must give information and answer data subject requests under Arts. 9 and 18 by electronic, printed or other means that secure the rights, and may organise through business associations or other persons to negotiate, mediate and conciliate complaints. They may keep the record of processing in simplified form on the ANPD's model; need not appoint an encarregado but must then provide a communication channel with data subjects (appointing one counts as good governance); must adopt essential and necessary technical and administrative security measures based on minimum requirements, and may adopt a simplified security policy scaled to their costs, structure and volume (following ANPD guidance counts in their favour when sanctions are weighed). They have double time to answer data subject requests, to communicate incidents (as Resolution 15/2024 provides), to provide the full Art. 19 statement and to supply information the ANPD requests, and may give the simplified access statement within 15 days.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.