Personal data must be processed in accordance with law; data subjects have the right to be informed of processing activities unless the law provides otherwise; data may be processed only for the purposes the controller, processor, controlling and processing entity or third party has registered and declared; collected data must be appropriate and within the scope and purposes of processing, and buying or selling personal data in any form is prohibited unless the law provides otherwise; data must be updated and supplemented for the processing purposes; protection and security measures must be applied throughout processing, against breaches and against loss, destruction or damage from incidents; data may be stored only for a period suitable to the purposes unless the law provides otherwise; and the controller and controlling and processing entity are responsible for complying with these principles and for demonstrating that compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.