Articles 38 and 39: approved codes of conduct bind adherents and may include out-of-court dispute resolution; they may be promoted by associations, companies or groups and public bodies and are approved by the AEPD or a regional authority; adherents must submit to the monitoring body complaints they intend to reject, may voluntarily have processing verified beforehand, and the data subject may still go to the authority; certification bodies may be accredited by ENAC.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.