Processing is lawful only where the data subject consented for purposes explained to them; processing is necessary for a contract with the data subject or pre-contractual steps at their request; the controller executes a legal obligation; processing is necessary to protect vital interests of the data subject or another person; it is necessary for a public-interest duty or official authority vested in the controller; it is carried out for the performance of duties of a public entity; it serves legitimate interests of the controller or a third party unless unwarranted having regard to prejudice to the data subject's rights, freedoms and legitimate interests; or it is carried out for research purposes authorised by the relevant institution.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.