Conduct Data Protection Assessment (DPA) under MCA 30-14-2815 for high-risk processing activities. MANDATORY DPA triggers: (a) processing of sensitive data; (b) processing for purposes of targeted advertising; (c) sale of personal data; (d) processing for profiling presenting reasonably foreseeable risk of (i) unfair or deceptive treatment of or unlawful disparate impact on consumers + (ii) financial physical or reputational injury + (iii) physical or other intrusion upon solitude or seclusion or private affairs + (iv) other substantial injury to consumers. DPA contents: categories of personal data + processing purposes + necessity assessment + benefit-vs-risk analysis + risks to consumers + safeguards employed + data flows + sharing arrangements + retention periods. DPA available to Montana Attorney General upon investigation request. Single assessment may cover comparable processing activities. Annual review encouraged though not mandated. DPA records retained per business records retention. Algorithm impact assessment for AI/ML profiling including bias testing + explainability + accuracy metrics + human oversight + appeal pathway.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.