Every processing activity must observe good faith and ten principles: purpose (legitimate, specific, explicit purposes made known to the data subject, with no later processing incompatible with them); adequacy (processing compatible with the purposes stated, in context); necessity (limited to the minimum needed, with pertinent, proportionate and non-excessive data); free access (easy, free consultation by data subjects on the form and duration of processing and on the completeness of their data); data quality (accuracy, clarity, relevance and currency as the purpose requires); transparency (clear, precise, easily accessible information about the processing and the processing agents, respecting commercial and industrial secrets); security (technical and administrative measures against unauthorised access and accidental or unlawful destruction, loss, alteration, communication or dissemination); prevention (measures to prevent harm arising from processing); non-discrimination (no processing for unlawful or abusive discriminatory purposes); and accountability (the agent demonstrates that it has adopted effective measures able to prove compliance, and that those measures work).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.