A controller must conduct and document a data protection impact assessment for each of: targeted advertising; sale of personal data; profiling presenting a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact, financial, physical or reputational injury, offensive intrusion on seclusion or private affairs, or other substantial injury; processing of sensitive data; and any other processing presenting a heightened risk of harm. The duty applies to processing activities created or generated after 31 December 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.