In compliance with the principles the controller and processor must implement appropriate technical and organisational measures, keep a record of processing operations, carry out a personal data protection impact assessment where processing is likely to result in a high risk to the rights and freedoms of a natural person, and perform other duties the supervisory authority assigns; an impact assessment is required for a systematic and extensive evaluation of personal aspects based on automated processing including profiling on which decisions with effects are based, large-scale processing of sensitive personal data, systematic large-scale monitoring of a publicly accessible area, processing the authority identifies as likely high risk, and new technologies used to process personal data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.