A processor must adhere to the controller's instructions and assist the controller in meeting obligations including responding to consumer rights requests, implementing reasonable security and conducting data protection assessments. A determination of whether a person is acting as a controller or processor is fact specific.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.