Processing is lawful only on at least one condition: (1) consent for one or more specific purposes; (2) compliance with the controller's legal obligation; (3) necessary and proportionate processing and sharing by State bodies for their own functions and public policies set in laws and regulations; (4) performance of a contract or pre-contractual step at the data subject's request; (5) regular exercise of rights in judicial, administrative or arbitral proceedings; (6) the controller's or a third party's legitimate interests unless overridden by the data subject's interests, rights and freedoms, particularly for a child or adolescent, and not available to the State within its constitutional limits; (7) protection of life, physical or mental safety or health of the data subject or a third party, only in a procedure by health professionals, services or authorities within their competence, or legal protection ordered by a competent authority in proceedings.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.