The responsible party must, by written contract with the operator, ensure the operator establishes and maintains the section 19 security measures; the operator must notify the responsible party immediately where there are reasonable grounds to believe that a data subject's personal information has been accessed or acquired by an unauthorised person.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.