Articles 32 and 33: heads of public institutions register each personal information file (name, basis and purpose, items, method, retention, regular recipients) with the Commission, except files on national security, criminal matters, tax offences, one-off files or classified files; for files meeting decree criteria that raise infringement risk they commission an impact assessment from a designated assessment body considering volume, third-party provision and risk, submit it to the Commission and attach it when registering; private controllers should strive to assess impact where risk arises.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.