Anyone acting under the controller's or processor's authority, and the processor, processes data only on the controller's instructions. Controllers, representatives and processors take appropriate technical and organisational measures against negligent or unauthorised destruction, loss, alteration, access or processing, proportionate to technology, cost, the nature of the data and risks, following any Authority security standards; controllers use processors that give sufficient security guarantees and bind them by written contract to maintain security. Breach of the processor requirement in s.18(4) is an offence (s.33(2)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.