Where personal data processing services are provided on behalf of third parties, the data may not be applied or used for a purpose other than that in the service contract, nor transferred to other persons even for storage; once the service is completed the processed data must be destroyed, unless the party on whose behalf the service was provided expressly authorises storage where further engagements may reasonably be presumed, in which case the data may be kept under due security conditions for up to two years. The processor's necessary access is not a communication of data (Decreto 414/009 article 14).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.