Processing is lawful only where at least one basis applies: consent for specific purposes; necessity for a contract with the data subject or steps at their request before contracting; a legal obligation of the controller; vital interests of the data subject or another person; a legal task in the public interest or public functions vested by law; or legitimate interests of the controller or a third party not overridden by the data subject's interests and rights, especially a child's (not available to public authorities performing their tasks). Legal obligation and public task bases must be laid down in a law that states the purpose, meets a public interest objective and is proportionate. Where a new purpose rests neither on consent nor on such a law, the controller must assess compatibility with the original purpose, considering the link between purposes, the context and the relationship with data subjects, the nature of the data (sensitive data or criminal records), the possible consequences and safeguards such as encryption or pseudonymisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.