A controller must conduct and document a data privacy and protection assessment for targeted advertising, the sale of personal data, processing of sensitive data, any processing presenting a heightened risk of harm, and profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or disparate impact, financial, physical or reputational injury, offensive intrusion on seclusion, or other substantial injury. The assessment considers the type and sensitivity of the data and the context, weighs benefits to the controller, consumers, stakeholders and the public against risks to consumers as mitigated by safeguards (factoring deidentified data, consumers' reasonable expectations and the relationship), and includes the 325M.18(a) policy description. It must be disclosed to the attorney general on written request in a civil investigative demand (it stays nonpublic and privileged); assessments done for other laws with similar scope qualify, and one assessment may cover comparable operations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.