Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: governance. Requirements include (a) DPO designation + (b) records of processing + (c) retention + (d) marketing safeguards + (e) training + (f) accountability framework.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.