Data are kept no longer than the purpose requires; the controller sets deletion or periodic review periods, and extended retention is allowed only for archiving in the public interest or scientific, historical or statistical research with appropriate safeguards. The Reglamento requires procedures for retention, periodic review and deletion; once the purposes are fulfilled and no legal duty, legitimate interest or legal obligation requires keeping them, the data must be deleted, blocked or anonymised; the database record (fichero) must state the retention period for the data, reflecting their subject matter, nature, processing and purpose; and data must be securely deleted at the end of that period, except where needed for public-interest reasons in public or private health or in State, security, labour and education matters, or for legal claims. The Authority may regulate retention periods and request information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.