An organisation must develop and implement policies and practices necessary to meet its obligations under the Act; develop a process to receive and respond to complaints about the application of the Act; communicate its policies and practices to its staff; and make information about those policies and practices and the complaint process available on request. The PDPC's guidelines add data protection impact assessments, data protection by design, staff training and a data protection management programme as the expected means.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.