A personal data system must be open at all reasonable times to inspection by the Commissioner or an inspection officer, who may require production of the consent records, the records of written notices under s. 7, the disclosure list, the security policy, records of compliance with the retention standard and with the data integrity standard, and any other related information (regulations 13 and 14; the inspection power is s. 101, which also covers data processors).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.