Controllers exempted under section 4 paragraph one (2) to (6) or by the 2023 Royal Decree under section 4 paragraph two must still keep security for personal data in any form to a standard covering organisational, technical and where needed physical measures across risk identification, prevention, detection, response and recovery, proportionate to risk and preserving confidentiality, integrity and availability; review measures when needed or when technology changes; require processors and others acting for them to keep appropriate security and report breaches without delay; and, where another law sets security duties, follow it without falling below this standard.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.