Per POPIA + Information Regulator guidance: governance + lifecycle. Requirements include (a) designate Information Officer where required - includes head of public + private body + delegated functions per POPIA + (b) maintain records of processing activities + (c) implement Notification to Data Subject (Section 18) - data subject must be notified of collection including identity of responsible party + purposes + recipients + retention + rights + (d) implement retention + disposal aligned to purpose + legal obligations + (e) deliver Training and Awareness across personnel + (f) maintain documented governance + accountability + (g) integrate with broader privacy programme.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.