Articles 45 and 46: a controller uses only processors giving sufficient guarantees of appropriate measures; a processor engages sub-processors only with the controller's prior specific or general written authorisation (with notice of changes and a chance to object), imposing the same obligations; processing is governed by a written contract or legal act setting subject, duration, nature, purpose, data types and categories of subjects, and requiring the processor to act only on documented instructions (including on transfers), bind staff to confidentiality, ensure security, respect sub-processing conditions, assist with rights and with security, breach and impact-assessment duties, delete or return data at the end, and provide information and allow audits; the Commissioner may issue standard contractual clauses; anyone acting under controller or processor authority processes only on instructions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.