Articles 12 and 14: processing is lawful only on consent for specific purposes, contract with the data subject or pre-contract steps, legal obligation, vital interests, public-interest tasks or legal powers of the controller, or legitimate interests of the controller or a third party unless overridden by the data subject's interests or rights, especially of a minor; public authorities may not use legitimate interests for their tasks; the legal-obligation and public-task bases must be set by a law stating the purpose, public interest and proportionality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.