A controller outsourcing processing must choose the processor scrupulously; the processor must comply with the law, act only within the controller's authorisation and have the necessary technical means, and both are civilly liable for breaches. Controller and processor must correct, complete, update or delete data they learn is inaccurate or insufficient and inform the data subject and lawful recipients of the change within two months, by registered letter or other written means.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.