Notify the data owner where a breach affects that person's personal data (6.3); notice to the data owner is not required where the provider has taken appropriate technical and organisational protection measures and applied them to the personal data affected by the breach (6.4). The 2021 text set 72 hours for the notice to the data owner; the 2024 text sets no separate deadline.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.