Where an offence under the Act is committed by a body corporate or firm, the body and its principal officers are deemed culpable unless the officers prove the offence was committed without their consent or connivance and that they exercised diligence to prevent it; a controller and processor are vicariously liable for the acts or omissions of their agents and employees so far as they relate to the business. Principal officers therefore evidence their diligence: oversight of the data protection programme, resourcing of the DPO and response to its reports.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.