Every controller or processor must keep a record of all processing operations under its responsibility, setting out its name and contact details (and any representative and data protection officer), the purposes, the categories of data subjects and of personal data, the categories of recipients including those abroad, transfers to other countries and, for section 36 transfers, the safeguards, where possible the erasure time limits, and a description of the section 22(3) verification mechanisms; the record is made available to the Office on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.