Data controllers and data processors of major importance register with the Commission within six months of the Act's commencement or of becoming a controller or processor of major importance, by notifying the name and address of the organisation and of its Data Protection Officer, a description of the personal data and the categories and number of data subjects, the purposes of processing, the categories of recipients, the name and address of any processor operating directly or indirectly on its behalf or its representative, the countries to which it intends to transfer personal data directly or indirectly, a general description of the risks, safeguards, security measures and mechanisms protecting the personal data, and any other information the Commission requires; the Commission publishes the register on its website and may exempt classes where registration is unnecessary or disproportionate. Under the GAID 2025 the thresholds and three tiers (ultra-high, extra-high and ordinary-high level) and the fees are set by the Commission's guidance notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.