In force (Article 27): a non-government agency holding personal data files must take appropriate security measures against theft, alteration, damage, loss or disclosure, proportionate and drawn from the ER 12 list (staff and resources, scope definition, risk assessment, incident prevention and response, internal procedures, data and staff security, awareness and training, equipment security, audit, logs and evidence, and continual improvement), and sector regulators may require a security maintenance plan and a method for handling data when business ends. Promulgated 2025, not yet in force: Article 27 is deleted and Article 20-1 imposes the security duty under Commission regulations, while during the Commission's first six years sector regulators may still designate agencies to adopt plans (Article 51-1), which they may make stricter.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.