Objective: decide whether a new or revised PIA is needed, starting from information about the programme, system or process. Output: the result of this threshold check and, where a PIA is needed, the mandate, terms of reference and scope. Management decides whether a PIA is required; if it is, management and the intended assessor set the terms of reference, the boundaries and applicability that define scope, and the organization decides and records the scale, the method and the audiences (and so the nature and content of the reports), recording the threshold result, scope and terms of reference in the report (7.2). A new or revised PIA is warranted when privacy impacts are expected from: a new or planned technology, service or initiative that processes PII; a decision to process sensitive PII; changes in privacy law or regulation, internal policy or standards, system operation, purposes or means of processing, or data flows; or business growth or acquisitions. An organization may adopt a policy with thresholds that trigger a PIA and baseline technical and organizational measures, marking out the space within which PII processing can proceed without a fresh PIA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.