Under article 40 of Ley 19.670, a data protection officer must be designated by public entities (state or non-state) and private entities wholly or partly state-owned, private entities that process sensitive data as their main business, and private entities that process large volumes of data, meaning personal data of more than 35,000 persons; the URCDP may rule on whether a private entity should have one. The officer advises on the formulation, design and application of data protection policies, supervises compliance, proposes measures to conform to the rules and international standards and verifies them, and acts as the link with the URCDP; may serve under any contractual form, must have accredited legal knowledge specialised in data protection (a legal-person officer must disclose its governing body and the natural persons assigned), must participate appropriately in all data protection matters with full access to databases and operations, technical autonomy and no instructions in the role, absolute confidentiality, and may hold other functions absent conflict of interest; the designation must be communicated to the URCDP within 90 days of the start of processing, and any cessation or resignation within the same period with a new designation; a group of entities with related activities, or public entities in one administrative structure, may appoint a single officer able to serve all of them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.