Controllers must implement appropriate technical and organisational measures at the time of determining means of processing and during processing, and by default only process data necessary for each purpose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.