The controller must erase personal data without undue delay where they are no longer necessary for the purpose, consent is withdrawn and no other ground exists, the data subject objects and there are no overriding legitimate grounds, or the data were unlawfully processed; where it made the data public it takes reasonable steps to tell third parties processing them of the request to erase links, copies or replications. Erasure does not apply where processing is necessary for public health, historical, statistical or scientific research, a legal obligation or public task, or legal claims.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.