SIG risk domain P, Privacy Management. The third party manages privacy beyond safeguarding: authorised collection, use and transfer of personal data, privacy-focused risk assessments for regulated data, and a program covering, in the SCA privacy section, program management, privacy organisation and maintenance, awareness, privacy risk assessments, notice, choice and consent, website compliance, management of client-scoped privacy data, data protection and privacy incident notification and response, third-party privacy agreements, and authorisations, monitoring and enforcement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.