The controller and processor must designate a data protection officer where the processing is carried out by a public or private corporate body or legal entity other than courts, where core activities require regular and systematic large-scale monitoring of data subjects, or where core activities consist of large-scale processing of sensitive data or criminal-conviction data; a group of undertakings may appoint one officer accessible from each establishment and public bodies may share one; the officer is designated on professional qualities and expert knowledge, may be staff or under a service contract, and the controller or processor must publish the officer's contact details and communicate them to the supervisory authority. Failure to designate is an administrative misconduct.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.