Personal information may be processed only if the data subject (or a competent person for a child) consents; processing is necessary for the conclusion or performance of a contract to which the data subject is party; it complies with a legal obligation of the responsible party; it protects a legitimate interest of the data subject; it is necessary for a public body's public law duty; or it is necessary for the legitimate interests of the responsible party or of a third party recipient. The responsible party bears the burden of proving consent, which may be withdrawn at any time without affecting prior processing; the data subject may object at any time on reasonable grounds relating to their situation to processing under the legitimate-interest, public-duty or third-party grounds (on the prescribed Form 1), and to direct marketing, after which the responsible party may no longer process the information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.