A data protection impact assessment is required where processing is likely to result in a high risk to the rights and freedoms of natural persons. The ANSPDCP has published an indicative list of operations requiring a DPIA, including large scale processing of special category data and systematic monitoring.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.