For sensitive personal data the processing party must apply the article 26 and 27 measures, designate a department with the function of protecting personal data and appoint personnel in charge of personal data protection, and exchange information about that department and person with the agency in charge of personal data protection (individuals acting as controller, processor, controlling and processing entity or third party exchange information about the persons protecting personal data), and must notify the data subject that their sensitive personal data is being processed, except in the article 13.4, 17 and 18 cases.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.