Both when deciding the means of processing and during processing, the controller must apply appropriate measures to comply with the Decree-Law, including the Article 5 controls; pseudonymisation is named as one such measure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.