Article 28: controllers and processors determine technical and organisational measures to ensure and demonstrate compliance, assessing whether a DPIA and prior consultation are needed, and must take particular account of higher risks where processing could cause discrimination, identity theft, fraud, financial loss, reputational harm or loss of professional secrecy, reversal of pseudonymisation, deprive people of control, involve non-incidental special or offence data, profile people, concern vulnerable groups (minors, persons with disabilities), be massive in scale, involve habitual transfers to non-adequate countries, or other factors in codes and certifications; processing without this prior assessment is a serious infringement (Article 73.p).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.