Only data strictly necessary, adequate and relevant to the purpose may be processed, and kept only as long as needed for it (4(d)); data may not be kept longer than necessary, with erasure and periodic review deadlines to be set by the supervisory authority, and archiving, research or statistical further processing is compatible where the data are anonymised or pseudonymised (4(e)). Regulations may allow retention past necessity for historical, statistical, scientific or judicial administration value.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.