The Controller keeps records of processing activities for the period the Regulations set, available to the Authority on request, containing at least contact details, purposes, categories of data subjects, recipients, transfers or disclosures abroad and expected retention (Law 31). Records are written, accurate and current, kept during processing and five years after it ends, and also record the DPO, data categories, retention per category where possible, recipient categories, transfers with their legal basis and recipients, and security measures where possible; the Authority provides templates (IR 33).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.