Per Saudi PDPL: consent + notice + sensitive data. Requirements include (a) Consent requirements + (b) Privacy notices + (c) Sensitive personal data safeguards + (d) Special protection for health + biometric + criminal records.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.