The controller or processor retains personal data until the purposes of processing are fulfilled, and may retain longer only where authorised by law, required by a contract between the parties, related to the function or activity for which the data were collected, for preventing, detecting, investigating, prosecuting or punishing offenders, protecting national security, enforcing a court order, enforcing public revenue legislation, court proceedings, authorised research or with the data subject's consent, or on further grounds set by regulation; at the end of the retention period the data must be destroyed in a manner that prevents reconstruction in an intelligible form.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.