A controller must conduct and document a data protection assessment for processing personal data for targeted advertising; selling personal data; profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact, financial, physical or reputational injury, offensive intrusion on seclusion or private affairs, or other substantial injury; processing sensitive data; and any processing presenting a heightened risk of harm. The duty covers processing activities generated on or after 1 July 2023.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.