A controller that adheres to cloud services by general contract terms may use them only where the provider has data protection policies similar to the Law's principles and duties, makes subcontracting transparent, claims no ownership of the information, keeps it confidential, and has mechanisms to disclose policy changes, let the controller limit the processing, maintain adequate security, suppress data at the end of service with the controller able to recover it, and prevent unauthorised access and inform the controller of authority requests; services that do not ensure proper protection may not be used.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.