Administrative penalties (rectification orders, warnings, fines on the entity and responsible persons, suspension of business, revocation of permits/licences) for failing to perform data-security obligations, with heavier penalties for core/important data violations and illegal cross-border transfer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.