Article 5: controllers, processors and everyone who takes part in any stage of processing are bound by the duty of confidentiality of GDPR Article 5.1.f, in addition to any professional secrecy, and the duty continues after the relationship with the controller or processor ends.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.