Controllers must establish and document a lawful basis under the Act for every category of personal data processed, with consent, contract, legal obligation, vital interest, public function, or legitimate interest each requiring distinct evidence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.