Owners, operators and third parties must take legal, organisational and technical measures ensuring the subject's protection from interference in private life, data integrity and safety, confidentiality and prevention of unlawful processing; data may not be disclosed or disseminated without consent or another lawful basis, and staff must not disclose data learned in their duties. The duty runs from collection until destruction or depersonalisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.