Per IPPs 9-10 of Privacy Act 2020 + agency-specific provisions: retention + use. Requirements include (a) IPP 9 - Retention of Personal Information - personal information should not be kept longer than is required for the purposes for which the information may lawfully be used + (b) IPP 10 - Limits on Use of Personal Information - personal information obtained for one purpose may only be used for that purpose unless an exception applies + (c) implement Retention and Disposal aligned to purpose + legal obligations + (d) implement use limits in systems + processes + including secondary use approvals + (e) maintain records of use + retention decisions + (f) integrate with broader records management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.