Processing is lawful only if it meets a Schedule I condition: consent; necessity for a contract with the data subject or pre-contract steps at their request; a legal obligation under written law; an emergency threatening life, health or safety; a public interest task or powers conferred by written law (including government circulars, directions or codes), where public interest covers public health and social protection, communicable disease control and official authorities' statutory purposes; or legitimate interests of the controller or a third party unless overridden by the data subject's interests, particularly for a child, with client or service relationships, reasonable expectation, strictly necessary fraud prevention and network and information security given as examples.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.