A data protection assessment must identify and weigh the direct and indirect benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the consumer's rights, as mitigated by the safeguards the controller can employ; it must factor in the use of de-identified data, consumers' reasonable expectations, the context of the processing and the controller-consumer relationship. The controller must make it available to the Division of Consumer Affairs on request; assessments are confidential and exempt from public inspection, and disclosure to the Division does not waive privilege.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.