Processing ends when the purpose is achieved or the data are no longer necessary or pertinent to it, when the processing period ends, on communication by the data subject (including revocation of consent), subject to the public interest, or on the ANPD's determination for breach of the law. Data must then be erased within the scope and technical limits of the activities, and may be kept only to comply with a legal or regulatory obligation, for study by a research body (anonymised wherever possible), for transfer to a third party respecting the processing requirements, or for the controller's exclusive use, with no third-party access and only if anonymised.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.