Processing is lawful only where at least one of the specified conditions is met (consent, contract, legal obligation, vital interests, public task, or legitimate interests).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.