Controllers and processors each meet their own obligations. A processor must follow the controller's instructions and assist it with appropriate technical and organisational measures to respond to consumer rights requests, meet security and breach-notification duties under section 325E.61, and supply information for the controller's data privacy and protection assessments. Controller and processor must implement technical and organisational security appropriate to the risk and clearly allocate responsibility for those measures between them. Whether a person is a controller or processor is a fact-based determination: a processor that is not limited by, or departs from, the controller's instructions, or begins determining purposes and means, is a controller for that processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.