Records of personal information must not be retained longer than necessary for the purpose unless retention is required or authorised by law, reasonably required for lawful purposes related to the responsible party's functions, required by contract, or consented to; longer retention for historical, statistical or research purposes needs safeguards; a record used to make a decision about a data subject must be retained for the period required by law or a code, or long enough to allow the data subject to request access; records must be destroyed, deleted or de-identified as soon as reasonably practicable once retention is no longer authorised, in a manner that prevents reconstruction in an intelligible form; and processing must be restricted where accuracy is contested pending verification, where the information is kept only for proof, where processing is unlawful and the data subject asks for restriction instead of deletion, or where the data subject asks to transmit the data to another system, with the data subject informed before a restriction is lifted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.