Article 18 with Decree Articles 21 to 24: outside the exempt, authorised and opinion regimes, processing is declared to the Commission des Données Personnelles (CDP) on its model form, with an undertaking that the processing meets the Law; the CDP acknowledges receipt and issues a receipt (récépissé) within one month (extendable once), and only that receipt allows the processing to start, without relieving the controller of responsibility. The declaration must reflect the processing as actually operated. Simplified declarations cover staff management, workplace access control, working time and canteen management, and workplace telephony; the CDP may publish simplification or exemption norms for common low-risk processing (Article 19).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.