A processor must follow the controller's instructions and assist it in meeting its obligations. A binding contract must govern the processing, setting out instructions, the nature and purpose of processing, the type of data, the duration and both parties' rights and obligations, and requiring the processor to impose a duty of confidentiality on each person processing the data; delete or return all personal data at the end of services as the controller directs unless law requires retention; make available on reasonable request all information needed to show compliance; engage subcontractors only after giving the controller an opportunity to object and under a written contract passing on the processor's obligations; and allow and cooperate with reasonable assessments by the controller or its assessor, or arrange a qualified independent assessment against an accepted control framework and provide the report on request. Each party keeps its own liability, and a processor that begins determining purposes and means becomes a controller for that processing. Applies to for-profit entities doing business in Rhode Island or targeting products or services to its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding data processed solely to complete a payment) or of at least 10,000 customers while deriving more than 20 percent of gross revenue from selling personal data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.