Articles 35 to 37: DPO qualification may be shown through voluntary certification schemes; the DPO is the contact point with the authorities, may inspect procedures and make recommendations, cannot be removed or penalised for performing the role except for intent or gross negligence, must avoid conflicts, has access to all data and processing notwithstanding confidentiality duties, and documents and immediately reports relevant breaches to management; data subjects may complain to the DPO before the authority, and the DPO answers within two months; an authority may pass a complaint to the DPO, who has one month to respond.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.