Apply lawful bases for processing per NDPA Section 25 including consent + contractual necessity + legal obligation + vital interests + public interest + legitimate interests. Obtain valid consent per Section 26 requirements (informed + specific + freely given + capable of withdrawal). Apply NDPA Section 24 data protection principles: lawfulness/fairness/transparency + purpose limitation + data minimisation + accuracy + storage limitation + integrity/confidentiality + accountability. Provide privacy notice with NDPA-mandated disclosures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.