Where an assessment shows likely risk of harm to data subjects' rights under the Act, the controller must put mitigating measures in place before processing. The 2025 Act removed the voluntary prior consultation and Authority instructions of subsections (2) to (6), but a controller doing section 24(1) processing for national security, public order or public health must still consult the Authority.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.