For retention of medical records under art. 7:454(3) Civil Code, processing under art. 30(3)(a) includes a care provider transferring records to another care provider, institution or facility that will keep and manage them, and that other party keeping and managing them. On a transfer the data subject is informed of it and of the applicable rights; where that is impossible, disproportionate or conflicts with professional secrecy, broad public notice in general terms is given in good time (30a(2)); where the data subject is not informed under GDPR art. 14(5)(b) or (d), general public notice is the appropriate measure (30a(3)). The transfer is free of charge (30a(4)) and needs no patient consent under art. 7:457 Civil Code (30a(6)).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.