Every controller or processor must ensure personal data are processed lawfully, fairly and transparently; collected for explicit, specified and legitimate purposes and not further processed incompatibly; adequate, relevant and limited to what is necessary; accurate and kept up to date, with every reasonable step taken to erase or rectify inaccurate data without delay; kept identifiable no longer than necessary; and processed in accordance with the rights of data subjects. The Act has six principles; accountability sits in section 22.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.