The Controller assesses the impact of processing for products or services according to its activity (Law 22). A written, documented assessment is required for sensitive data; combining or linking datasets from different sources; continuous, large-scale processing of those lacking capacity, continuous monitoring, new technologies or automated decision-making; and products or services likely to seriously harm privacy. It covers at least the purpose and legal basis, nature of processing, data types and sources and recipients, scope including geography, context and relationships, necessity and proportionality, likelihood and severity of material, moral, psychological, social, physical or financial impact, measures to prevent or limit risks, and their suitability; a copy goes to processors, and where harm is found the causes are addressed and the assessment redone (IR 25).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.