A DPIA follows five steps: describe the processing (nature, scope, context, purposes, data flows and any cross border transfer); evaluate compliance, necessity and proportionality; identify and score specific risks on a 3 by 3 likelihood and impact matrix; consider measures (collect less, shorten retention, add security, anonymise or pseudonymise, change technology, add contractual safeguards, run a TIA); and assess residual risk. High residual risk (and by default all risks) is reported to senior management, which accepts the risk, adds measures and allocates resources; mitigations are implemented and monitored; a DPIA is valid for two years and refreshed on expiry or relevant change; records are kept at least two years after the processing ends and produced to the Commissioner on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.