Personal information may be processed only if not otherwise prohibited by law and at least one condition exists: the data subject's consent; necessity for a contract with the data subject or for pre-contractual steps at the data subject's request; compliance with a legal obligation of the controller; protection of the data subject's vitally important interests including life and health; response to a national emergency, public order and safety, or the fulfilment of a public authority's functions; or the legitimate interests of the controller or of a third party recipient, except where overridden by the data subject's fundamental rights and freedoms protected under the Constitution.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.