Data subjects may have their data deleted where processing breaches the principles, is not necessary or relevant, the purpose has been fulfilled, the retention period has expired, processing affects fundamental rights or freedoms, consent is withdrawn or was never given for a purpose, or a legal obligation requires it. The controller must use methods that delete the data or make them definitively and securely illegible or unrecognisable, within 15 days of the request and free of charge.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.