Third-party processors must comply with the NDPR or an adequate law in their country, process only on authority expressly granted by the controller in a written agreement specifying each party's data protection roles and obligations, maintain adequate information security and process measures, and rectify, give access to or delete data on the controller's instruction where possible or redirect such requests to the controller.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.