The Commissioner's data protection by design guideline asks data controllers and processors to embed technical and organisational measures implementing the principles across the lifecycle from design to decommissioning, on four elements (proactiveness, end-to-end protection, transparency, user-centricity): settle purpose and legal basis before processing, minimise and review data, anonymise or delete when identification is no longer needed, stop processing when the basis lapses, allocate responsibilities where several parties process, design consent withdrawal into systems, and govern it through senior management commitment, periodic audits and DPIAs (the governance practices are stated as non-mandatory).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.