Processing is lawful only on one of six bases: consent for specific purposes, performance of or steps toward a contract, a legal obligation, vital interests, a task in the public interest or official authority, or legitimate interests not overridden by the data subject's interests, rights and freedoms (especially a child's); public authorities cannot rely on legitimate interests for their tasks. Bases in law must meet a public interest objective and be proportionate. Where further processing is not based on consent or a law, the controller must assess compatibility with the original purpose by considering the link between purposes, the context and relationship, the nature of the data (special categories and criminal data), the possible consequences and the existence of safeguards such as encryption or pseudonymisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.