A processor shall adhere to the instructions of a controller and assist the controller in meeting its obligations, including responding to consumer rights requests and providing reasonable information necessary to demonstrate compliance. Processing by a processor shall be governed by a contract between the controller and processor that clearly sets forth instructions for processing, the nature and purpose, the type of data, duration, and the rights and obligations of both parties. Notably, UCPA does NOT require formal Data Protection Assessments (DPAs) unlike VCDPA, CPA, and CTDPA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.