A processor that becomes aware of a personal data breach must notify the controller as soon as it becomes aware; the controller then informs the Office under Article 9(1).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.