Processing personal data without the data subject's consent is prohibited unless one of the listed cases applies: protection of the public interest; data the data subject has made public; initiating or defending legal claims or judicial or security procedures; occupational or preventive medicine, diagnosis, health or social care, treatment or health insurance under the laws in force; public health, including epidemics and the safety and quality of health care, medicines and devices; archiving or scientific, historical and statistical studies under the laws in force; protecting the data subject's interests; the controller's or data subject's obligations and rights in employment, social security or social protection law; performing a contract with the data subject or taking steps at their request to conclude, amend or end one; meeting obligations placed on the controller by other UAE laws; and any further case the Executive Regulations add. The controller must be able to say, for each processing activity, whether it rests on consent or on which listed case.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.