Put in place an accountability programme proportionate to the organisation and the risks, led by the DPO and overseen at Board level where applicable, with policies on conformance to the code, the GDPR and PECR, staff training for those designing the service, records of processing under Article 30(1) regardless of size, retained DPIAs, children's privacy KPIs in internal and external reporting, and readiness to demonstrate conformance to the ICO with DPIAs, policies, training records, processing records and working evidence of settings, tools and profiling; Article 42 certification against the code can support this when available.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.