Processing must be necessary, adequate and relevant to the purposes in the privacy notice, and for sensitive data the controller must make reasonable efforts to limit the processing period to the minimum indispensable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.