Where personal information is used for purposes unrelated to the collection purposes, the organisation specifies them and shows that each rests on the individual's express consent (describing how it was obtained, meeting the consent quality requirements) or is compelled by applicable law (describing how). Requirement 9 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.