Personal data processed under one of section 12's exceptions (legal compliance, investigations, legal claims, requested services, contract, security and fraud, research, internal operations and the others listed) may be processed only for the expressly listed purpose and only to the extent necessary, reasonable and proportionate to it; a controller relying on an exemption bears the burden of demonstrating that the processing qualifies and complies (166.15(e)). Data kept for internal uses under 166.15(b) must be protected by reasonable administrative, technical and physical measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.