Processing is lawful only if at least one applies: (a) consent for one or more specific purposes; (b) necessity for a contract with the data subject or pre-contract steps at their request; (c) necessity for a legal obligation of the controller; (d) necessity to protect the vital interests of the data subject or another natural person; (e) necessity for a task in the public interest or in exercise of an official public mandate vested in the controller.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.