The retention period is the one set by law or regulation or, failing that, what the purpose requires; where the end cannot be fixed in advance (archiving in the public interest, research, statistics) retention is lawful with technical and organisational safeguards including informing the data subject of the retention; data needed to prove compliance with contractual or other obligations may be kept until the corresponding rights prescribe; when the purpose ends the controller must destroy or anonymise the data; where the law imposes a retention period, erasure under GDPR Article 17 can be exercised only when it ends; pension contribution records may be kept without time limit with safeguards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.