Controllers and processors must conduct DPIAs where applicable: before projects involving intense use of personal data and periodically on processes, services and technology. A DPIA may be required for evaluation or scoring (profiling), automated decisions with legal or similar effects, systematic monitoring, sensitive or highly personal data, vulnerable or differently-abled data subjects, and innovative processes or new technological or organisational solutions; NITDA may demand submission of a DPIA for high-impact processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.