The controller must keep, in writing or electronically, at least: (1) the personal data collected; (2) the purpose of collection for each category; (3) details of the controller; (4) the retention period; (5) rights and methods of access, including who may access and on what conditions; (6) uses or disclosures under section 27 paragraph three; (7) rejected requests or objections under sections 30, 31, 32 and 36; and (8) a description of the security measures under section 37(1). The record must enable the data subject and the Office to check it and applies to the foreign controller's representative. Items (1) to (6) and (8) may not apply to a small organisation under Committee rules unless the processing is likely to risk data subjects' rights, is not occasional, or involves section 26 data (see the RoPA exemption notifications).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.