Data subjects may request destruction of data no longer needed (Law 4(5)); the Controller destroys data without undue delay once no longer necessary for its purpose, may keep it only in a form that cannot identify the person, and must retain it where a legal basis sets a period (destroying it at the later of that period or the purpose ending) or where it is tied to a pending judicial case (destroying it when proceedings end) (Law 18). Destruction is due on request, when the data is no longer needed, on withdrawal of consent that was the sole basis, or on learning of unlawful processing; the Controller notifies parties and individuals to whom it disclosed the data and asks them to destroy it, and destroys all copies including backups (IR 8).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.