All personal data automatically triggers data protection impact assessments, as its jurisdiction requires. Automation opportunity: start assessments based on factors like where the data infrastructure is located, the classification of the data or the stated consumption purpose. Certification test steps: confirm the catalog exists and scanning recurs; report personal data and identify sensitive assets with no privacy classification, confirming they go to remediation; create a personal data asset and confirm it is identified as sensitive and private and that the privacy impact assessment updates; move an asset to a new storage location, and create a new use or sharing from a new location, and confirm the assessment updates each time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.