A PIA's scope, content and method should fit the organization's size, its jurisdiction and the particular programme, system or process being assessed. Each step of clause 6 is laid out the same way: an objective to reach, the input likely to be needed, the output to aim for, the actions (or equivalents) that get there, and implementation guidance on points to consider while acting. The actions, tailored to the PIA's scope and scale, can be used on their own or folded into a risk-based management system such as ISO/IEC 27001, with the PIA report (clause 7) used to treat the risks found. 'Conducting a PIA' covers both a first PIA and a revision in which only the needed steps are repeated; Annex C explains the terms used; and to help SMEs, their industry bodies should be encouraged to write codes of conduct consistent with the standard, which data protection authorities may endorse.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.