The organisation has written policies and procedures to notify affected individuals without unreasonable delay once it confirms a loss, unauthorised access, destruction, use, modification or disclosure, or other misuse of personal information likely to cause them significant harm. Notices cover the nature and extent of the breach and the information involved, steps individuals can take to protect themselves, what the organisation is doing to investigate, mitigate and prevent recurrence, and contact details of its privacy personnel. New requirement in the updated set; Accountability Agents certify against it from 1 April 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.