Under GDPR Article 35(4) the Commissioner lists processing that requires a DPIA before it starts: systematic monitoring (online behaviour tracking, legally required covert processing, geolocation including for direct marketing, large-scale monitoring of public or publicly accessible spaces); automated decisions, including profiling, with legal or similarly significant effects; special categories or vulnerable persons' data processed with innovative technologies or new methods; large-scale special categories or criminal offence data; biometric identification in public or publicly accessible spaces, together with criminal data, or of minors, employees, patients, mentally ill persons or asylum seekers; genetic data matched or combined beyond reasonable expectations (other than by an individual health professional serving the patient); data of vulnerable persons such as children, employees and social assistance recipients; and employee evaluation or scoring or processing that increases the power imbalance. DPIAs need no authorisation; prior consultation is required only where residual high risk remains after mitigation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.