Before any wholly or partly automated processing operation, controllers notify the Authority, and notify later changes; public registers are exempt and the Authority may exempt low-risk categories or controllers that have appointed a data protection officer, whose appointment must be notified. The notification states at least the legal basis, controller details, the processing name and purposes, data categories (describing sensitive data), data subject categories, safeguards for disclosures, how subjects are informed and can exercise access, linked processing, retention period, a preliminary security assessment, use of processors, and planned transfers. The Authority may inspect security and organisational measures before high-risk processing or transfers and later on reasonable notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.