An agency may collect, use or disclose personal data only for purposes under a recognised basis and notified to the individual where required; it must state the purposes on or before collection and any new purpose before use or disclosure (not required for deemed consent or no-consent processing), but must always inform employees and appointees of the purpose and, on request, a contact person; and keep documentation of purposes up to date.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.