Where a controller intends to create a filing system and a DPIA shows the processing would result in high risk without mitigation, it must consult the Commissioner before processing, providing the DPIA and any information requested; if the Commissioner thinks the processing would infringe Part 3 it gives written advice within six weeks, extendable by one month with reasons.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.