The responsible party or user of a database must adopt the measures necessary to guarantee the security and confidentiality of personal data, aimed at preventing their adulteration, loss, consultation or unauthorised processing and at detecting deviations of information, intentional or not, whether the risks come from human action or the technical medium; data must be stored so as to allow the data subject's right of access; and registering personal data in databases that do not meet technical conditions of integrity and security is prohibited. Decreto 64/020 article 3 adds availability, refers to national and international standards such as AGESIC's Cybersecurity Framework, and requires incident response procedures to start within 24 hours of an incident being confirmed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.