Articles 28-2 to 28-5 and 28-7: pseudonymised information may be processed without consent for statistics, scientific research (including technology development and private research) and public-interest archiving; when provided to third parties it must not include information that can identify a person; combining pseudonymised data of different controllers must be done by a designated combination agency, with export only after approval; controllers keep the additional information separately, apply decree safeguards, may set a processing period, keep records of purposes, recipients and periods (for three years after destruction), must not process to identify individuals, and must stop, retrieve and destroy any identifying information that emerges; several rights and notice duties do not apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.