Every processing of personal data must be declared in advance to the Instance Nationale de Protection des Données à Caractère Personnel (INPDP) by the controller or its legal representative, deposited against receipt or sent by registered letter or any means leaving a written trace, on the form set by Decree 2007-3004; the INPDP's silence for one month after the declaration counts as acceptance. The declaration does not remove liability to third parties. Processing without a declaration is an offence (one year and 5,000 dinars). Employers processing staff data needed to run the work, and processing needed to follow a person's health, are exempt from the declaration.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.