The responsible party is responsible for violations of the Law; as rewritten in 2018 the principle is proactive: responsible parties and processors must adopt, according to the nature of the data, the processing and the risks, the technical and organisational measures that demonstrate compliance, taking into account the state of the art, the cost, the nature, scope, context and purposes of processing and the risks of varying likelihood and gravity for persons' rights; the measures must be documented, periodically reviewed and evaluated for effectiveness, and the documentation must cover at least the form, means and purpose of processing, the procedures for complying with data protection rules, the planning of mechanisms to respond to security breaches, and the role of the data protection officer where applicable, and be available to the URCDP on request (Decreto 64/020 article 5).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.