Article 56: controllers and processors must designate a data protection officer if processing is by a public authority (except courts acting judicially), if core activities involve regular and systematic monitoring of data subjects on a large scale, or if core activities involve large-scale special-category or criminal data, and competent authorities processing for law-enforcement purposes must always designate one; a group may share a DPO easily reachable by each member; the DPO is chosen for expert knowledge, may be employed or contracted, and the controller publishes the DPO's contact details and sends them to the Commissioner, which keeps a register. Failing to designate is fined under Article 95(1); failing to publish and notify the contacts is fined at 100,000 dinars.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.