Before starting processing, the responsible party and where applicable the processor must carry out a data protection impact assessment where the operations may use sensitive data as the main business, involve permanent or stable processing of specially protected data or data on criminal, civil or administrative infringements, evaluate personal aspects to create or use profiles (work performance, economic situation, health, preferences, reliability, solvency, location), process data of groups in special vulnerability such as minors or persons with disabilities, process large volumes of personal data, transfer data to States or organisations without adequate protection, or in other cases the URCDP determines; the assessment must contain at least a systematic description of the processing and its purpose, an evaluation against the data protection rules, an evaluation of the risks to data subjects' rights, and the security measures and mechanisms to demonstrate compliance; existing processing had to be assessed within one year of the decree; where a potential and significant risk results, the URCDP must be informed with details of the measures adopted or to be adopted and the timeline; the URCDP sets criteria.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.