Article 3: a controller specifies the purpose and lawfully and fairly collects only the minimum personal information needed; processes it only as the purpose requires and not for other uses; keeps it accurate, complete and current; manages it securely in line with the risk to data subjects; discloses its processing (including the privacy policy) and guarantees rights such as access; minimises intrusion into privacy; processes anonymously where that achieves the purpose, otherwise pseudonymously; and works to earn data subjects' trust by meeting its duties. Personal information covers information on a living individual identifiable directly, or when readily combined with other information, and pseudonymised information (Article 2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.