Persons processing personal data should maintain records sufficient to demonstrate compliance with the Act, including purposes, categories, retention, and protective measures applied to the data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.