Any disclosure of data (anything that lets others know of data, by viewing, circulating, publishing, transferring, using, displaying or sending) must: keep the data protected and secure; be proportionate to the purpose of the request; not impair the data subject's ability to exercise their rights; not result in identifying the data subject directly or indirectly; and be limited to the minimum data needed for the specific purpose, retained only as long as that purpose requires. Without prejudice to other legislation, personal data may be disclosed without consent only for judicial procedures or security purposes, compliance with laws and regulations, international agreements to which the Kingdom is party, or protecting the data subject's life or vital interests.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.