Article 34: besides GDPR 37.1 cases, a DPO is mandatory for professional associations, schools and universities, electronic communications operators processing at large scale, information society providers profiling users at large scale, credit institutions, financial credit establishments, insurers and reinsurers, investment firms, electricity and gas distributors and suppliers, credit and fraud common files (including anti-money laundering files), advertising and market research entities profiling or using preferences, health centres keeping patient records (not individual practitioners), commercial reporting entities, online gambling operators, private security companies and sports federations processing minors' data; appointments and removals, mandatory or voluntary, are notified to the AEPD or regional authority within ten days; the DPO may be full or part time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.