Reports may be kept only for the time strictly necessary and proportionate to their handling and to the protection of reporters, persons concerned and third parties, allowing for further investigations; data may be kept longer only if individuals are neither identified nor identifiable, and personal data are processed in line with the GDPR. The AFA recommendations add that where no action follows, identifying data are destroyed or anonymised within two months of closing the verification, and where action follows data may be kept until the end of proceedings or limitation (paragraphs 281 to 283).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.