Before a new processing activity the controller must carry out an impact assessment under Article 31(1) to (5), (8) and (9). It must consult the Commissioner before processing data to be held in a new filing system where the assessment shows high risk because mitigation is absent or not readily applicable, or where the type of processing (new technologies, mechanisms or procedures) presents high risk, providing the assessment and the Article 32(4) information; the controller may authorise the processor to consult. The Commissioner's opinion must be obtained on laws or sub-legal acts regulating such processing, and the Commissioner may publish the operations that need prior consultation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.