The controller or processor must log at least the operations of collecting, altering, accessing, disclosing (including sharing and transfer), combining and erasing personal data; the log must indicate the justification, date and time of each operation and, where possible, the contact details of the person who accessed or disclosed the data and of the recipients; the supervisory authority may require access to the logs to verify lawfulness. Failure to log is an administrative misconduct (article 53).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.