The Controller selects only processors giving the necessary guarantees and monitors their compliance, remaining responsible to data subjects and the Authority (Law 8). The agreement states the purpose, data categories and duration; the processor's duty to report breaches without undue delay; whether the processor is subject to foreign regulations and their effect; that mandatory legal disclosures need no prior consent but are notified to the Controller; and any subcontractors or other recipients. The Controller gives clear instructions, the processor reports instruction or legal breaches in writing without undue delay, the Controller assesses processor compliance periodically (possibly through an independent third party), a processor breaching instructions becomes a Controller, and sub-processors need sufficient guarantees and the Controller's prior acceptance with a right to object (IR 17).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.