Before processing that uses modern technologies posing a high risk to the privacy and confidentiality of personal data, the controller must assess the impact on personal data protection, taking account of the nature, scope and purposes of processing. The assessment is required where processing involves a systematic and comprehensive evaluation of personal aspects by automated processing, including profiling, with legal consequences or serious impact, or processing of a large volume of sensitive personal data. The Office is to publish a list of processing types that need no assessment (Article 21(6)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.