Electronic processing is legitimate where one of four conditions is met: the data subject's consent for a specified purpose; necessity for performance of a contractual or legal obligation or an agreement for the data subject's benefit, or for claiming/defending the data subject's legal rights; necessity for a legal obligation or an order of competent investigation authorities or a judicial ruling; or necessity for the controller to perform its obligations or a relevant person to exercise legitimate rights, unless this contradicts the data subject's fundamental rights and freedoms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.