When deciding the means of processing and during processing, the controller must implement measures designed to implement the principles effectively and integrate the necessary safeguards, and must ensure by default that only data necessary for each purpose are processed, in amount, extent, storage period and accessibility, and that data are not made accessible to an indefinite number of people without an individual's intervention.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.