Processors (companies, partnerships and freelancers processing for controllers) must keep a record of processing activities in writing or electronically listing their own name and details, each controller they act for, the data protection officer, the categories or nature of processing, the categories of recipients where data is sent abroad, and a description of security measures. Small-enterprise processors in the same categories as the controller exemption, not required to appoint a DPO and not doing risky, non-occasional or section 26 processing, are exempt from keeping it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.