A controller carrying out sensitive processing on consent or a Schedule 8 condition must have a document explaining its procedures for complying with the principles and its retention and erasure policies with likely retention periods, must retain, review and update it and make it available free to the Commissioner, from the start of the processing until six months after it ends, and its section 61 record (and a processor's) must state the consent or condition relied on, how section 35 is satisfied, and whether the retention policy was followed, with reasons if not.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.