Every controller must run internal controls and procedures, the Data Protection Management Programme, that keep catalogued records showing how sections 5 to 11 are met, are designed around the structure, scale, volume and sensitivity of its processing, apply safeguards drawn from impact assessments, are built into governance, provide internal oversight, include a way to take complaints, hold inquiries and detect breaches, are updated through monitoring and assessment, and make it possible for data subjects to exercise their rights. The 2025 Act removed the Authority's duty in s.12(2) and instead, through new s.51A, lets it issue guidelines on the programme; a DPA working draft of such guidelines is held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.