Per Sri Lanka PDPA 2022: scope + lawful basis. Align with DPA (Data Protection Authority).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.