Processing is lawful only where the data subject has given and not withdrawn consent for the specific purpose, or the processing is necessary for the performance of a contract with the data subject or steps at the data subject's request before a contract, for compliance with a legal obligation of the controller or processor, to protect the vital interests of the data subject or another person, for a task in the public interest or the exercise of official authority, or for the legitimate interests of the controller, processor or a third-party recipient; an interest is not legitimate where it overrides the fundamental rights, freedoms and interests of the data subject, is incompatible with the other bases, or the data subject would not reasonably expect the processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.