Access to student and parent data is restricted to employees whose role requires it and who are subject to the Professional Secrecy Act or belong to a regulated profession or have taken an oath of confidentiality (including persons supervised by such professionals). A student aged 16 or over gives consent and exercises all GDPR Chapter III rights personally; consents are in writing or by a clear online opt-in; on written withdrawal the controller stops that processing and deletes or destroys the data concerned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.