The controller must communicate a reportable incident to the ANPD within three business days of learning that it affected personal data (unless specific legislation sets another period; small processing agents have double), by the ANPD electronic form, through the encarregado with proof of the employment or contractual link or through an appointed representative with a power of attorney filed within the same deadline. The communication must include: the nature and category of the data affected; the number of data subjects, separating children, adolescents and older people where applicable; security measures before and after the incident; the risks and possible impacts; reasons for any delay; measures taken or planned to reverse or mitigate effects; the date of the incident where known and the date the controller learned of it; the encarregado's or representative's details; the controller's identity and any declaration that it is a small agent; the processor's identity where applicable; a description of the incident including its main cause where identifiable; and the total number of data subjects in the affected processing activities. The information may be supplemented, with reasons, within 20 business days; it is for the controller to request confidentiality of legally protected information, and the ANPD may request further information such as the record of processing, the impact report and the incident handling report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.