Articles 41 and 42: the controller implements appropriate technical, organisational and staffing measures to ensure and be able to demonstrate compliance, reviewed and updated as needed, including data protection policies where proportionate; when determining the means and during processing it applies measures such as pseudonymisation and data minimisation (by design) and ensures that by default only data necessary for each purpose are processed, as to amount, extent, retention and accessibility, and not made accessible to an indefinite number of people without the person's intervention; approved certification may help show compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.