Before proceeding with new processing operations the controller must review its privacy protection measures; the NCGAA DPIA guideline (PDPPL-02050206E) operationalises this as a data privacy impact assessment that must be carried out for any processing activity that may cause serious damage to individuals' privacy or personal data, screening for indicators such as special-nature data, children, large scale, new technologies or profiling, identifying risks, mitigation and the information needed to consult the NCGAA, and treating it as good practice for existing activities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.