The controller and the processor must each appoint a data protection officer with sufficient skills and knowledge of personal data protection where (a) processing would cause a high risk to confidentiality and privacy because of new technologies or the volume of data, (b) processing involves a systematic and comprehensive evaluation of sensitive personal data, including profiling and automated processing, or (c) processing covers a large volume of sensitive personal data. The DPO may be an employee or an authorised person, inside or outside the State. The Executive Regulations are to specify the technologies and volume criteria (Article 10(4)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.