The controller and controlling and processing entity must compile and maintain a processing impact assessment dossier from the start of processing containing their contact details, the name and contact details of the organization and officers assigned to protect personal data, the purposes, the categories of data, the recipients including in other countries, any international transfer, the processing and erasure time limits, a description of the protection measures, and an assessment of impact with the likely unexpected consequences and damages and the measures to address them; the processor must compile a corresponding dossier when performing contracts with the controller (contact details, assigned organization and officers, description of processing activities and data categories under the contracts, time limits, international transfer, general protection measures, likely consequences and mitigations); the dossier is in writing and binding, an original on Form 04 must be available for the Ministry of Public Security (A05) within 60 days of the start of processing, the Ministry may require completion of an incomplete dossier, and the dossier must be updated on Form 05 when its contents change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.