Per POPIA Sections 12-15: purpose + collection + further processing. Requirements include (a) implement Collection Directly from Data Subject (Section 12) - personal information must be collected directly from the data subject + with limited exceptions + (b) implement Purpose Specification (Section 13) - information must be collected for a specific + explicitly defined + lawful purpose + (c) implement Further Processing Limitation (Section 15) - further processing must be in accordance with or compatible with the original purpose + (d) provide notice to data subjects per Section 18 + (e) maintain records of collection sources + purposes + further processing decisions + (f) maintain change management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.