Every controller must adopt policies and implement appropriate technical and organisational measures to ensure, and be able to demonstrate, that its processing complies with the Act. The measures include security under section 31, the record of processing under section 33, a data protection impact assessment under section 34, prior authorisation or consultation under section 35, and designating an officer responsible for data protection compliance (the designation the Data Protection Officers Regulations 2026 regulate). The controller must also implement policies and mechanisms that verify those measures are effective.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.