A controller engaging a processor, or a processor engaging another processor, ensures that the engaged processor complies with the principles and obligations of the Act as they apply to the controller; assists, by appropriate technical and organisational measures, in honouring data subject rights under Part VI; implements appropriate technical and organisational measures for security, integrity and confidentiality as Part VII requires; provides the information reasonably required to comply and to demonstrate compliance; and notifies the engaging party when a new processor is engaged. These measures include a written agreement between the controller and the processor or between processors.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.