Anyone processing personal data, directly or through another, must take all necessary precautions to secure it and stop third parties modifying, altering or consulting it without the data subject's authorisation, in particular physical protection of equipment, protection of media from being read, copied, changed or moved, prevention of unauthorised input, consultation or deletion, prevention of unauthorised use of systems, the ability to verify afterwards who accessed the system and what was entered when and by whom, protection in transmission and transport, and secure backup copies. Breach is an offence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.