Before collection or processing that poses a high risk to the rights and freedoms of natural persons, the collector, processor or controller carries out a data protection impact assessment describing the processing and purposes, assessing risks and the measures to address them, and covering anything the Office requires; the Office publishes the list of operations that need one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.