Where a Schedule 1 condition requires it, the controller must have an appropriate policy document explaining its procedures for complying with the Article 5 principles for that processing and its retention and erasure policies with an indication of retention periods. The document must be retained while the processing continues and for six months after it ends, reviewed and updated from time to time, and made available to the Commissioner on request free of charge. The Article 30 record for such processing must state the condition relied on, how the processing satisfies Article 6, and whether data are retained and erased in line with the policy, with reasons where not.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.