Retention may not exceed what the purposes need, taking account of administrative, accounting, tax, legal and historical requirements; once the purposes are met the controller blocks and then cancels the data. Controllers must establish and document procedures for preservation, blocking and suppression including the retention periods, and be able to show that data are preserved, blocked, suppressed or cancelled on those periods or on a cancellation request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.