The Controller appoints one or more data protection officers where the Regulations require (Law 30(2)): a Public Entity providing services involving large-scale processing, core activities requiring regular and continuous large-scale monitoring, or core activities of sensitive data processing. The officer may be an official, employee or external contractor and monitors compliance, oversees procedures and receives requests, in particular acting as contact point with the Authority and implementing its decisions, supervising impact assessments, audits and evaluations and issuing recommendations, enabling data subject rights, notifying breaches, answering requests and complaints, maintaining the processing records and handling violations with corrective action; the Authority issues appointment rules (IR 32).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.