The owner or operator must designate a structural unit or official responsible for processing and protecting personal data and organise its work under the Model Procedure for processing personal data, must approve the set of data needed for its tasks, and must be able to prove consent where legislation requires.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.