Controllers whose main or only establishment is in Latvia must carry out a data protection impact assessment at least for: criminal conviction and offence data or related security measures; scientific or historical research without consent combined with one of the nine WP248 criteria; cases where the Article 19 notification to data subjects proves impossible; genetic data used for unique identification with one criterion; surveillance on a large scale, at the workplace or directed at vulnerable data subjects; innovative technologies or procedures with one criterion; systematic monitoring of employee activities; large-scale tracking (lifestyle apps, logistics); location data with one other criterion; information society services offered directly to children; large-scale automated processing and processing based on profiling; combining data from various sources for matching, comparison and re-use; and biometric identification with one other criterion. The list is not exhaustive: the Article 35(1) high-risk test still applies to all other processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.