The controller must erase data without undue delay where it is no longer necessary, consent is withdrawn and no other basis exists, the data subject objects under Article 22(1) with no overriding grounds or under Article 22(2), the data was unlawfully processed, erasure is legally required, or the data was collected for information society services offered to a child. Having made data public, it must take reasonable steps, including technical measures, to inform other controllers of the request to erase links, copies or replications. Exceptions: freedom of expression and information, legal obligation or public task, public health, archiving, research or statistics where erasure would seriously impair them, and legal claims.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.