Article 68: the body grants a permit only if purposes match Article 53(1), data are necessary and proportionate, the GDPR lawful basis and pseudonymisation justification are met, the applicant is qualified, safeguards are sufficient, ethics and opt-out justifications comply, and national security and regulatory confidentiality risks are mitigated; it decides within three months of a complete application (extendable by three; two plus one for public health bodies under the accelerated procedure), may offer an anonymised statistical answer instead, requests data immediately and provides them within two months of receipt, states reasons for refusal, and sets permit content (data, purpose, authorised persons including the principal investigator, duration up to 10 years, once renewable, tools, fees, conditions); data are deleted within six months after expiry.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.