Each time new processing of personal data, or a change to current processing, is planned, the organization must judge whether a privacy impact assessment is required and carry one out where appropriate. It must decide what the assessment should cover, which may include the kinds of personal data involved, where the data is held and where it could be sent, supported by data flow diagrams and data maps. It should recognise that some jurisdictions make an assessment compulsory in cases such as automated decisions producing legal effects, large-scale processing of special categories, or systematic large-scale monitoring of publicly accessible areas.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.