Per Norwegian PDPA + GDPR Articles 25 + 30 + 35: accountability instruments. Requirements include (a) conduct Data Protection Impact Assessment (DPIA) for high-risk processing per GDPR Article 35 + Datatilsynet lists + (b) implement Privacy by Design and Default across systems + processes + products + procurement per GDPR Article 25 + (c) maintain Records of Processing Activities per GDPR Article 30 including purposes + categories + recipients + retention + safeguards + (d) maintain Internal Compliance Programme including governance + roles + monitoring + improvement + (e) integrate with broader privacy + risk + IT governance + (f) maintain documented accountability framework.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.