Processing by a processor must be governed by a binding contract setting out the processing instructions, including the nature and purpose of processing; the type of personal data and the duration; the confidentiality, subcontracting and security requirements of 166.16(c) and (d); deletion or return of all personal data at the end of services at the controller's choice unless law requires retention; the processor making available all information necessary to demonstrate compliance; and the processor allowing and contributing to reasonable assessments and inspections by the controller or its assessor, or, with the controller's consent, arranging an annual independent assessment at its own expense against an appropriate and accepted control standard or framework, with the report provided on request. No contract relieves either party of its statutory liabilities (166.16(f)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.