Personal information may be processed with the consent of the data subject (or of a competent person for a child); adults with full capacity may consent impliedly. Without consent, ordinary data may be processed where needed as evidence of an offence, to meet a legal obligation, to protect vital interests, for a public interest task or official authority, or for legitimate interests not overridden by the data subject's rights, with the Authority able to specify when legitimate interests apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.