The processor and any person acting under the authority of the controller or processor with access to personal data may process it only on the controller's instructions unless Montenegrin law requires otherwise, and controller and processor must take steps to ensure this.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.