The processor must receive personal data only after reaching an agreement or signing a contract on data processing with the controller, process the data in accordance with that contract or agreement, fully implement the protection measures the Decree and relevant laws require, answer to the data subject for damage caused by its processing, erase or return all personal data to the controller after completing the processing, and cooperate with the Ministry of Public Security and competent agencies and provide information for investigations and the handling of breaches.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.