A data controller of major importance designates a Data Protection Officer with expert knowledge of data protection law and practice and the ability to carry out the tasks prescribed under the Act and its subsidiary legislation; the DPO may be an employee or engaged by service contract; the DPO advises the controller or processor and the employees who carry out processing, monitors compliance with the Act and related policies, and acts as the contact point for the Commission on processing issues (the GAID 2025 adds the DPO's position, certification and a semi-annual internal data protection report).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.