The responsible party and where applicable the processor must build into the design of databases, processing operations, applications and IT systems measures directed at compliance, applying before and throughout processing appropriate technical and organisational measures such as dissociation, pseudonymisation and data minimisation techniques, mechanisms to secure the exercise of data subjects' rights, documentation of consents or other legitimising grounds, retention periods by data type and processing, contingency plans including information security measures, functional analyses and data architecture models, and other measures the URCDP sets (D.8); and must ensure that by default only the personal data necessary for each specific purpose are processed, as to the quantity collected, the extent of processing, the retention period and the communication (D.9).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.