A provider of a public electronic communications service must notify the Commissioner of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it; a later notification must give reasons for the delay, and information not yet available may follow in phases without undue further delay (Commission Regulation (EU) No 611/2013, Article 2, as amended). Failure to notify remains subject to the fixed monetary penalty in regulation 5C rather than a penalty notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.