Where processing is likely to result in a high risk to the rights and freedoms of a data subject by its nature, scope, context and purposes, the controller carries out a data privacy impact assessment before the processing: a systematic description of the envisaged processing and its purpose including any legitimate interest pursued, an assessment of the necessity and proportionality of the processing, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address the risks, safeguards, security measures and mechanisms to protect the personal data taking account of the rights and interests of data subjects and others. Where the assessment still indicates a high risk the controller consults the Commission before processing; the Commission may prescribe by regulation or directive the categories of processing and persons subject to the requirement (the GAID 2025 does, and requires the DPIA to be signed by a certified DPO and filed).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.