Personal data is not collected or processed without the data subject's prior consent unless authorised or required by law, necessary for a public body's duty, national security, law enforcement, a contract with the data subject, medical purposes or a legal obligation; when a data subject objects (by Form 1) to processing that rests only on consent, it stops, except for processing on the legal grounds or on a legitimate interest (such as fraud prevention, network and information security, crime prevention, internal administration) that the controller bears the burden of establishing; processing without consent in breach of s.7(1) is an offence with daily fines and possible revocation of registration.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.