Sensitive personal information (biometric, racial or ethnic, political, religious or philosophical, health, sexual, criminal or financial record, genetic and any regulated category) may be processed only where a section 27 basis is met and also consent, or necessity for vital interests of someone incapable of consenting, employment or social security obligations, medical care or community welfare under a duty of confidentiality, public health with safeguards, substantial public interest under a proportionate law, legal claims or advice, a not-for-profit body's members with no outside disclosure without explicit consent, archiving or research under a law, or the data subject having made it public.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.