Processing must follow the Law's principles and rest on a listed ground: the subject's consent, performance of or steps toward a contract with the subject, the owner's or operator's legal obligations, protection of the lawful interests of the subject or another person, the lawful interests of the owner, operator or a third party or socially significant goals where subjects' rights are not infringed, statistical or research use with mandatory depersonalisation, or data from publicly available sources. Processing to protect the subject may start before consent can be obtained.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.