Per Thailand PDPA + PDPC: governance + lifecycle. Requirements include (a) appoint Data Protection Officer (DPO) where required (large-scale processing + sensitive data + monitoring) with defined responsibilities + reporting to highest management + (b) maintain Record of Processing Activities including purposes + categories + recipients + retention + safeguards + (c) implement Retention Limitation including retention schedules + secure deletion + anonymisation + (d) implement Direct Marketing and Communications safeguards including consent + opt-out + suppression lists + (e) deliver Personnel Training and Awareness programmes including role-based content + PDPA + privacy + security + breach response + (f) maintain documented governance + accountability framework.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.