The organisation limits collection, directly or through third parties, to personal information relevant to the stated or compatible purposes, and identifies each type of data collected, its stated collection purpose, every use applied to it and why each use is compatible with or related to that purpose, so the amount and type collected can be verified as relevant. (Wording revised in the updated set.) Requirement 6 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.