When processing sensitive personal data the controller or processor must comply with the Law's protection and monitoring requirements; comply with the applicable retention periods; put in place measures to strengthen the capacity of staff involved; put in place measures controlling access to the sensitive data; and implement technical and organisational measures giving a level of security appropriate to the risk to the data subject, including where appropriate storing sensitive data separately and applying tokenisation, pseudonymisation or encryption.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.