Handlers must proactively delete PI where the purpose is achieved/impossible or no longer necessary, retention period expires, consent is withdrawn, handling violates law/agreement, or handling ceases; if deletion is technically hard, handling must stop except for storage and necessary security.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.