No person may process personal data unless the data subject consents for one or more specified purposes, or the processing is necessary for a contract with the data subject or pre-contract steps at the person's request, compliance with a legal obligation, the vital interests of the data subject or another person, a task in the public interest or in the exercise of official authority, a task of a public authority, the exercise in the public interest of other public functions, legitimate interests of the controller or a recipient third party unless unwarranted given the harm and prejudice to the data subject, or historical, statistical or scientific research. Processing without a ground is an offence (fine up to Rs 100,000, up to 5 years).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.