Personal data must be retained no longer than necessary for the purposes of processing. Upon achievement of the purposes or upon withdrawal of consent, data must be destroyed or depersonalised unless retention is required by law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.