Small processing agents (micro and small enterprises, individual microentrepreneurs, startups, private legal entities including non-profits, natural persons and unincorporated private entities acting as controller or processor) may use the simplified regime unless they carry out high-risk processing, exceed the revenue limits of Complementary Law 123/2006 or, for startups, Complementary Law 182/2021, or belong to a group whose global revenue exceeds them. Processing is high risk when it meets at least one general criterion (large scale, or able to significantly affect data subjects' interests and fundamental rights) and at least one specific criterion (emerging or innovative technologies; surveillance or control of publicly accessible areas; solely automated decisions including profiling; or sensitive data or data of children, adolescents or older people). The agent must prove its eligibility within 15 days when the ANPD asks, and the ANPD may order it to comply with any waived or relaxed obligation in view of the circumstances.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.