A controller must review a minors' data protection assessment as needed to account for material changes to the processing, and keep its documentation for the longer of three years after the processing ceases or until it stops offering the service. The assessment is confidential and not a public record, must be made available to the attorney general on request, and its disclosure waives no attorney-client privilege or work product protection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.