A data controller may process personal information, or let a processor do so, only with the data subject's unwithdrawn consent for the specific purpose, or where necessary for a contract with the data subject or pre-contract steps, the vital interests of someone whose consent cannot reasonably be obtained, a legal obligation, authorised processing by a competent public authority, a public interest task or official authority, legitimate interests not overridden by the data subject's fundamental rights, archiving or historical, statistical or scientific research, or compliance with a written law of the Kingdom.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.