A controller must conduct and document a data protection assessment for targeted advertising, sale of personal information, profiling with a reasonably foreseeable risk of unfair or deceptive treatment, disparate impact, financial, physical or reputational injury, intrusion or other substantial injury, processing of sensitive data, and other heightened-risk processing, weighing benefits to all stakeholders against risks to consumers as mitigated by safeguards, and taking account of de-identification, consumer expectations and context. Assessments may cover comparable operations together or reuse assessments done for other laws, and must be produced to the Attorney General under a civil investigative demand (they stay confidential and privileged).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.