Taking into account the nature, scope, context and purposes of the processing and the varying likelihood and severity of the risks, the controller of research or statistical processing must implement these additional appropriate measures: (1) appoint a data protection officer; (2) carry out an impact assessment of the planned processing; (3) anonymise or pseudonymise the data (Article 4(5) GDPR) or apply other functional separation so the research data cannot be used to take decisions or actions about the data subjects; (4) use a trusted third party, functionally independent of the controller, for anonymisation or pseudonymisation; (5) encrypt the data in transit and at rest with state-of-the-art key management; (6) use privacy-enhancing technologies; (7) restrict access to the data within the controller; (8) keep log files that show the reason, date and time of each consultation and identify who collected, modified or deleted data; (9) raise the awareness of the staff involved about data protection and professional secrecy; (10) evaluate the effectiveness of the technical and organisational measures regularly through an independent audit; (11) draw up a data management plan in advance; (12) adopt sectoral codes of conduct under Article 40 GDPR approved by the European Commission under Article 40(9).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.