Controllers must declare or seek authorisation from the Commission de Protection des Donnees Personnelles (CDP) before commencing processing operations, with stricter authorisation required for sensitive data and certain processing types.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.