Before processing involving systematic and extensive evaluation of personal or special category data including profiling, systematic surveillance of public spaces or of telecommunication networks, or other processing set by rules, the controller must carry out an impact assessment in the prescribed form on its effect on Part I obligations and Part II rights, including mitigation measures, with the DPO's help; it must redo the assessment when the method, technology or process changes, and (after 2025) supply the assessment and related information to the Authority on written request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.