Controllers collecting personal data without consent for historical documents or archives in the public interest (including national archives law) or for research or statistics must use organisational and technical, and where needed physical, measures limiting collection to what the purpose requires, meet at least the section 37(1) minimum security standard, and consider anonymisation, pseudonymisation, encryption or similar measures in proportion to risk, taking into account technology, context, accepted standards for similar entities, the nature and purpose of processing, resources and feasibility.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.