The controller is responsible for data in its custody or possession and for data communicated to a processor, whether or not in Mexico, and must adopt measures to guarantee proper processing, at least: binding privacy policies and programmes; training and awareness; internal supervision and external audits; resources for the programme; a procedure to assess and mitigate privacy risk of new products, services, technologies and business models; periodic review of security policies and programmes; a procedure for data subjects' questions and complaints; enforcement mechanisms and sanctions; data protection measures; and data tracing measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.