In force: an agency holding personal data files must designate specific personnel, competent to manage and maintain them and trained for it (ER 25), to handle security so data is not stolen, altered, damaged, lost or disclosed, and must adopt personal data security rules (ER 24); security measures are the technical and organisational measures listed in ER 12. Promulgated 2025, not yet in force: each agency must also appoint a Chief Personal Data Protection Officer, a person designated by the agency head with suitable staff and resources to coordinate and oversee data protection in the agency and bodies it supervises; security measures will follow Commission regulations; staff performing protection duties may not be penalised for doing so.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.