A processor must follow the controller's instructions and help it comply, including by appropriate measures for consumer rights requests, by assisting with security of processing (from 1 January 2026 expressly including personal data collected, stored and processed by an artificial intelligence system) and with breach notification under Chapter 521, and by providing information for data protection assessments; role is a fact-based question and a processor that follows instructions stays a processor.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.