The data controller (not the processor, which must assist under contract) must carry out a data protection impact assessment where a processing operation is likely to result in high risk: always where it is expected to involve more than 20,000 data subjects, or sensitive personal data including financial information of more than 10,000; otherwise where the DPO judges qualitative factors to indicate high risk (legal or significant effects, systematic monitoring, innovative technology, denial or restriction of rights, tracking of location or behaviour, targeting of children or vulnerable people, automated decision-making and profiling). Senior management bears ultimate responsibility; the DPO advises; a DPIA lead runs it with the relevant stakeholders.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.