A controller must document and maintain a description of the policies and procedures it has adopted to comply with the Act, including, where applicable, the name and contact information of its chief privacy officer or other individual with primary responsibility for them, and policies and procedures reflecting 325M.16 and designed to build the Act's requirements into system design, identify and provide personal data to consumers, maintain reasonable data security with a data inventory, limit collection, prevent over-retention, and identify and remediate violations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.