Before processing likely to affect subjects' rights, a DPIA on Form No. 9 is required, including for significant automated decisions or profiling, large-scale reuse, biometric or genetic data, significant changes, children's or vulnerable groups' sensitive data, dataset matching, large-scale processing or public-area monitoring, novel technology, and processing that blocks rights; where the assessment shows possible impact the report goes to the Commission, which may stop or condition the processing (the processor may proceed if no instruction comes within 30 days) and later audits compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.