A controller may not retain personal data no longer relevant and reasonably necessary for the purposes for which it was collected and processed, unless retention is required by law or permitted under 325M.19.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.