Authorisation from the Commissioner is required before processing sensitive data under Article 7 item 2 letter c and before processing personal data under Article 9 item 1, unless that processing is already authorised by a legal provision, and processing needing authorisation may begin only once the authorisation is received.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.