Outside Article 6 data, a non-government agency needs a specific purpose and one of: a statute expressly providing (or a specifically authorised order, ER 9); a contract or quasi-contractual relationship with the person with appropriate security measures (including pre-contract contacts and post-contract communications, ER 27); data the person or law has made public; de-identified public interest research by academic institutions; consent; necessity for the public interest; data from generally available sources (media, internet, news, gazettes, ER 28) unless the person has an overriding interest in prohibiting its use; or no harm to the person's rights.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.