Where a breach probably creates a substantial risk for individuals' protected interests, the controller notifies the data subjects without delay in clear and plain language with at least the contact point, likely consequences and measures. This is not required where effective protection such as encryption applied, subsequent measures remove the substantial risk, or it would take disproportionate effort (then a public communication or equally effective measure is used). The Federal Commissioner may find the conditions not met; notification may be deferred, restricted or omitted on the s 56(2) grounds unless the data subjects' interests prevail given the high risk.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.