Appoint a Data Protection Officer where the entity is a public body, processes sensitive information at scale or carries out regular and systematic monitoring, with the DPO position resourced, independent and reachable by data subjects and POTRAZ.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.