The data subject may request erasure where the data are no longer necessary for the agreed purpose (accepting possible damage), on withdrawal of consent, on objection without a legitimate reason to continue, where processing is outside the agreed purpose or unlawful, or where the law requires erasure; erasure is refused where the law does not allow it, where a competent state agency processes the data for its operation, where the data were lawfully disclosed, where processing serves legal requirements, scientific research or statistics, in emergencies of defence, security, disaster or epidemic, or to respond to an emergency threatening life, health or safety; data pass to successors on division, merger, consolidation, dissolution or reorganisation under law; all personal data collected must be erased within 72 hours of the data subject's request unless the law provides otherwise; controllers, processors and third parties must store data in a form suited to their operations with protection measures, and must permanently erase data where the purpose was improper or has been completed, where storage is no longer necessary for their operation, or where the entity is dissolved, ceases operating, is bankrupt or terminates business.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.