A controller may use only processors guaranteeing sufficient measures to meet Part 3 and protect data subjects' rights. Sub-processors need prior specific or general written authorisation, with notice of changes under a general authorisation. A written contract must set out the subject matter, duration, nature, purpose, data types, data subjects and each party's obligations and rights, and require the processor to act only on instructions, bind its people to confidentiality, assist with data subject rights, delete or return data at the end and delete copies, provide information demonstrating compliance, follow the sub-processor rules, and transfer data abroad only when instructed for the particular transfer. A processor that determines purposes and means is treated as a controller.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.