All processing requires the data subject's consent unless an exception applies. Consent may be express (verbal, written, electronic, optical, unequivocal signs or other technology) or tacit (the privacy notice was made available and the person did not object); tacit consent is valid as a rule unless the law requires express consent, and financial or patrimonial data require express consent save the article 9 and 36 exceptions. Consent may be revoked at any time without retroactive effect, and the privacy notice must set out the mechanisms and procedures to revoke it. Consent is not needed where a legal provision so provides, the data are in public access sources, the data were dissociated, they are needed to exercise a right or meet obligations of a legal relationship with the data subject, there is an emergency that could harm a person or property, they are indispensable for medical care while the person cannot consent (by someone bound by professional secrecy), or there is a reasoned order or mandate of a competent authority.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.