Outsourcing follows PIPA Article 26(1) to (3); outsourcers designated by Decree notify the FSC of the scope of information provided; identifying information given to processors is encrypted or otherwise protected; processors are trained and the contract includes safe-processing terms; processors use or provide the data only as PIPA Article 26(5) allows; and processors may not sub-outsource without FSC recognition that protection is not impaired. The Act's security, retention, conduct, confidentiality and liability provisions apply to processors.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.