A controller or processor outside the United Kingdom caught by Article 3(2) must designate a representative in the United Kingdom in writing, unless its processing is occasional, excludes large-scale special category or criminal offence data and is unlikely to result in risk, or it is a public authority. The representative is mandated to be addressed by the Commissioner and data subjects on all processing issues, without prejudice to actions against the controller or processor itself.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.