A party commissioned to collect, process or use personal data is treated as the commissioning agency within the scope of the Act and must follow the rules that apply to it and act only within its instructions, telling the commissioning agency at once if an instruction seems unlawful. The commissioning agency must supervise the contractor appropriately, covering at least the scope, categories, purpose and period of the data, the contractor's security measures, any sub-contractors, notice and remedies if the contractor breaches the law, any reserved instructions, and return or deletion of data at the end, and must check performance periodically and record the results.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.