Article 22 with Decree Article 31: declarations, authorisation requests and opinion requests state the identity and address of the controller (or its mandated representative if established abroad), purposes and general description, interconnections, data processed with their origin and categories of data subjects, retention period, the departments and categories of staff with direct access, authorised recipients, where the right of access is exercised, security measures, use of a processor, and intended transfers to third countries. A new filing is needed when these change; the Decree requires notice within fifteen working days of a change and within one month of deleting the processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.