So that gathering and processing personal data does not intrude on privacy, an organization should: collect only personal data that is needed to supply products and services, or that the consumer has given with informed, voluntary consent; not make access to services or special offers depend on the consumer accepting unwanted marketing use of their data; gather data only lawfully and fairly; state why data is being collected before or when it is collected; not disclose, share or use personal data for anything beyond the stated purposes, marketing included, unless the consumer gives informed, voluntary consent or the law requires it; let consumers check whether it holds data about them and dispute that data, and where a challenge succeeds, erase, correct, complete or amend it; keep personal data secure with adequate safeguards; be transparent about its developments, practices and policies on personal data and offer easy ways to find out whether personal data exists, what kind it is and what it is mainly used for; and make known who is responsible for data protection (the data controller) and where that person is normally based, holding them to account for meeting these measures and the law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.