ISO 31000:2018 6.2 applies, plus a list of those who may be consulted or informed in privacy risk work: privacy specialists; those responsible for privacy matters; designers and developers of products, systems and services that handle PII; owners of systems that process PII; managers and officers who decide on or run PII processing; supervisory authorities; and PII principals themselves, alone or through groups such as organizations or associations. Where the law of a jurisdiction requires a particular consultation for certain processing, for example with a supervisory authority, the organization should know which consultations it owes and be able to show it carried them out on time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.