A person who intends to be a data controller or data processor must register with the supervisory authority, indicating their identity and designated single point of contact, the identity and address of any representative, a description of the personal data to be processed and the categories of data subjects, whether they hold or are likely to hold the types of personal data of their sectors, the purposes of processing, the categories of intended recipients, the countries to which they intend to transfer personal data directly or indirectly, and the risks in processing and the measures to prevent them and protect the data; the authority may add requirements by regulation and issues the certificate within thirty working days. Operating without a certificate is an administrative misconduct and false information in registration an offence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.