A controller is prepared to demonstrate its privacy management programme as appropriate, in particular when a competent privacy enforcement authority asks, or when a body responsible for a code of conduct, seal or certification scheme that gives binding effect to the Guidelines asks. Being able to show capacity and effectiveness, even without a breach or complaint, is what makes the accountability real.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.