Data under a restriction must not be processed incompatibly with its collection purpose unless the law provides or the data subject explicitly consents; the controller must secure it under GDPR Article 32 against accidental destruction, loss or unlawful processing; retain it no longer than the processing purpose, the aim of the restriction or the law requires; and inform the data subject of the restriction unless that would prejudice its purpose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.