In automated processing systems the controller (or processor) must keep logs of collection, alteration, consultation, disclosure including transfers, combination and erasure. Consultation and disclosure logs must show the date and time and, so far as possible, who consulted or disclosed the data and the recipients. Logs may be used only to verify lawfulness, for self-monitoring including internal discipline, to ensure integrity and security, and for criminal proceedings, and must be given to the Commissioner on request. The former requirement to log the justification for consultation and disclosure was removed with effect from 19 August 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.