Special categories of personal data may be processed only where section 28 applies and a further condition is met: legitimate activities with safeguards by a not-for-profit body with a political, philosophical, religious or trade union aim, confined to members, former members or regular contacts and not disclosed outside without consent; data manifestly made public by the data subject; or necessity for legal claims, preventive or occupational medicine, working capacity assessment, diagnosis, health or social care and their management (by or under a professional bound by secrecy), the controller's or data subject's obligations and specific rights, or the vital interests of a person physically or legally incapable of consenting. Contravention is an offence (fine up to Rs 100,000, up to 5 years). The special categories include offences, proceedings and sentences.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.