A controller must conduct and document a data protection assessment for each processing activity presenting a heightened risk of harm to consumers, including targeted advertising, sale of personal data, processing of sensitive data, and profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact, financial, physical or reputational injury, offensive intrusion on seclusion, or other substantial injury. The assessment weighs the direct and indirect benefits to the controller, consumer, other stakeholders and the public against the risks to consumers' rights as mitigated by safeguards, and factors in de-identified data, consumers' reasonable expectations, the context and the relationship. The attorney general may require disclosure of an assessment relevant to an investigation, including through a civil investigative demand; assessments stay confidential and disclosure waives no privilege. One assessment may cover comparable operations, an assessment done for another law that is reasonably similar in scope and effect counts, and the duty applies to processing activities created or generated after 1 January 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.