An accredited person must not specify a consent period longer than 12 months, except that a consent from a CDR business consumer that includes a business consumer statement may run up to 7 years, provided the consumer is offered a period of 12 months or less when more than 12 months is proposed. It must not ask for a collection, use or disclosure consent unless acting under it would comply with the data minimisation principle, and must not ask for a consent outside the defined categories or for using CDR data, including by aggregation, to identify, compile insights about or build a profile of any identifiable person other than the consumer, except to derive data about that person's interactions with the consumer for the requested service.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.