Before collecting, using or disclosing personal data an agency must check laws governing or prohibiting it, and may proceed only where the activity serves a Public Sector (Governance) Act s 4 purpose to the extent of a Ministerial direction, is authorised by law or court order, is necessary in the public (including national) interest, falls within the no-consent exclusions of Annex A or Annex B, or the individual has given or is deemed to have given consent for the stated purposes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.