The organization must not keep personal data for longer than its processing purposes need. It must draw up and maintain retention schedules that reflect legal, regulatory and business requirements; where those requirements pull in different directions, it must make a business decision grounded in a risk assessment, document it and enter it in the relevant schedule.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.