Processing by a processor must be governed by a binding contract setting out the processing instructions, the nature and purpose of processing, the type of personal data, the duration and both parties' rights and obligations. It must require the processor to bind every person processing the data to confidentiality; engage subcontractors only after giving the controller an opportunity to object and under a written contract imposing the processor's obligations; delete or return all personal data at the end of services at the controller's choice unless the law requires retention; make available all information needed to demonstrate compliance on reasonable request; and allow and contribute to reasonable assessments and inspections by the controller or its assessor, or alternatively arrange at least an annual independent assessment at its own expense against an accepted control standard, with the report available to the controller. No contract relieves either party of its liabilities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.