Any planned processing involving automated decision-making or profiling triggers a DPIA, overseen by the DPO. Where processing involves ADM or profiling the notice under s. 7 must say so (the types of decisions, the reasons and the possible consequences, without trade secrets), stay accessible and be updated as the activity evolves, and state the use of AI where AI is used; data subjects must have accessible, user-friendly mechanisms to withdraw consent under s. 38, after which the ADMP processing stops; ADMP on sensitive data needs explicit consent or a s. 40(1)(b) ground.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.