Apply data minimisation + purpose limitation + retention + secure deletion per Oman PDPL Articles 7 + 9 + 10. Data minimisation requires collecting only personal data necessary for the documented lawful purpose + with periodic review of necessity. Purpose limitation requires using personal data only for the original purpose for which it was collected unless compatible purpose or subsequent lawful basis exists. Retention requires (a) defining retention periods per data category per processing purpose + (b) implementing automated retention enforcement where possible + (c) maintaining retention schedule documented and reviewed periodically. Secure deletion requires applying NIST SP 800-88 or equivalent sanitisation methods per media type + maintaining deletion logs + with cryptographic erase + degaussing + or physical destruction as appropriate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.