The controller must keep a record of every security incident, including those not communicated to the ANPD and data subjects, for at least five years from the date of the record unless other obligations require longer, containing at least: the date the incident became known; a general description of the circumstances; the nature and category of the data affected; the number of data subjects affected; the risk assessment and possible damage; the correction and mitigation measures, where applicable; the form and content of any communication; and the reasons for not communicating, where that was the case. Public bodies follow their records retention schedules instead of the five-year period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.