The Controller collects data directly from the data subject and processes it only for the collection purpose, except with consent; where the data is publicly available or from a publicly available source (whose lawfulness must be checked); for a Public Entity's public interest, security, legal or judicial needs; where compliance would harm the data subject or their vital interests; to protect public health or safety or specific individuals' life or health; where the data will not be recorded or stored in an identifying form (applying the anonymisation rules); or for the Controller's legitimate interest without sensitive data (Law 10; IR 15). Third-party-sourced processing must be necessary, proportionate and not affect the data subject's rights (IR 15). For further processing the Controller defines the new purpose clearly and records it in the processing records, maps data to purposes, and limits data to the minimum (IR 18).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.