The controller obtains or receives personal data from the holder or the competent entities only after the data subject's consent or another legal permission; ensures the data is valid, conformant and sufficient for the collection purpose; sets the method, manner and standards of processing for the designated purpose unless it has delegated that to a processor in writing; and ensures the specified collection purpose applies to the processing objectives.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.