Apply NDPR Section 2.5 sensitive personal data protections covering racial or ethnic origin + religion + political opinions + trade union membership + health + sexual orientation + biometric + genetic data + criminal records. Process children personal data with parental consent under 13. Publish privacy policy per NDPR Section 2.6 with mandated disclosures including data categories + purposes + lawful basis + rights + complaints procedure + DPO contact.
The graph holds this control, the 7 it maps to, and the evidence behind each claim, over MCP and REST.