Schedule 1, First Principle: personal data must be processed fairly and lawfully, and only if at least one Schedule 2 condition (and, for sensitive data, a Schedule 3 condition) is met, with specified information provided to the data subject.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.