The controller or processor must maintain a record of all processing activities under its responsibility showing the name and contact details of the controller and where applicable the processor, the representative or the data protection officer; the purposes; the categories of data subjects and of personal data; a full list of recipients to whom data have been or will be disclosed, including those in other countries; a description of transfers outside Rwanda; and where possible the envisaged retention periods; and must submit the record to the supervisory authority on request. Failure is an administrative misconduct.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.