Article 26: outsourcing processing requires a document covering the ban on processing beyond the outsourced purpose, technical and managerial safeguards and decree items; the outsourcer discloses the outsourced work and processors (including sub-processors) so data subjects can easily check, notifies data subjects directly for marketing outsourcing, trains processors and supervises that they process safely (checking status as the decree sets); processors may not use data beyond the scope, need the outsourcer's consent to sub-outsource, count as the controller's staff for damages, and are bound by most of the Act.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.