Each controller must keep a record of all categories of processing with its and any joint controller's and DPO's details, purposes, recipient categories (including abroad), categories of data subjects and data, any profiling, categories of transfers, the legal basis including for transfers, erasure time limits where possible and a general description of security measures; each processor must keep a record of processing for each controller with sub-processors, transfers on explicit instruction and security measures. Records must be given to the Commissioner on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.