Both when determining the means and when processing, the controller must implement appropriate measures, such as pseudonymisation, designed to implement the principles effectively and integrate safeguards, and must ensure by default that only data necessary for each specific purpose is processed as to amount, extent of processing, storage period and accessibility, and in particular that data is not by default made accessible to an indefinite number of people without the individual's intervention. Approved certification may help demonstrate this.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.