Personal data is not kept longer than needed unless law, a lawful related purpose, a contract or consent require it (law enforcement, security, penalty, revenue, court and research purposes excepted); data used to decide about a person is kept for the legal period or long enough for the person to request access; at the end of the retention period records are destroyed, deleted or de-identified so they cannot be reconstructed; a controller that stops processing keeps any data it still holds secure and handles it under the Act.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.