Personal data must be processed fairly and lawfully, collected for specified, explicit and legitimate purposes and not further processed incompatibly, adequate, relevant and not excessive for those purposes, accurate and where necessary kept up to date with every reasonable step taken to erase or rectify inaccurate or incomplete data, and kept in identifiable form no longer than necessary for the purposes. Retention beyond that period for historical, statistical or scientific purposes requires CNDP authorisation on the controller's request and a legitimate interest. The controller is responsible for compliance, under the CNDP's supervision.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.