Personal data processed under a 30-14-2816 exemption may be processed only to the extent reasonably necessary and proportionate to the listed purpose and adequate, relevant and limited to what is necessary, with the nature and purpose of internal-use processing considered, and must be protected by reasonable administrative, technical and physical measures reducing reasonably foreseeable risks of harm. A controller relying on an exemption bears the burden of showing that the processing qualifies and meets these conditions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.