Where personal information is disclosed or transferred for unrelated purposes, the organisation specifies them and shows each is based on express consent (and how it is given), necessary to provide a service or product the individual requested, or compelled by law, outlining the legal requirement unless confidentiality forbids. Requirement 13 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.