Where a controller relies on the permitted uses in Subchapter E (legal compliance, investigations, claims, requested services, safety, security and fraud, research, internal operations), processing must be reasonably necessary and proportionate, adequate, relevant and limited, and protected by reasonable safeguards, and the controller bears the burden of showing the exemption applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.