On becoming aware of a breach or violation of personal data that would prejudice privacy, confidentiality and security, the controller must notify the Office of it and of the investigation findings, within the period and under the procedures the Executive Regulations set, with: a description of the nature, form and causes of the breach and the approximate number of data subjects and records; the DPO's details; the potential and expected effects; the corrective measures taken or proposed; documentation of the breach and corrective actions; and anything else the Office requires. Under Article 9(4) the Office verifies the causes and may impose Article 26 penalties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.