Electronic processing is legitimate where it rests on the data subject's consent for specified purposes; is necessary and intrinsic to performing a contractual obligation or legal act, executing an agreement for the data subject's benefit or claiming or defending the data subject's legal rights; is necessary to perform a legal obligation, an order of the competent investigating authorities or a judicial ruling; or is necessary for the controller to perform its obligations or for a relevant person to exercise legitimate rights, unless that contradicts the data subject's fundamental rights and freedoms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.