Handling is permitted only on one of the legal bases: individual consent; necessity for a contract or HR management; statutory duties/obligations; public health or emergency; news reporting/public interest within reasonable scope; already-disclosed information within reasonable scope; other circumstances provided by law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.