The controller must also communicate a reportable incident to the data subjects within three business days of learning that it affected personal data (double for small agents), in simple, easily understood language and directly and individually where they can be identified (by the usual means such as telephone, email, electronic message or letter), stating: the nature and category of the data affected; the security measures used; the risks and possible impacts; reasons for any delay; measures taken or to be taken, where applicable; the date the incident became known; and a contact point, with the encarregado's details where applicable. If individual communication is not feasible or data subjects cannot all be identified, the controller must publish the communication through its available channels (website, apps, social media, service channels) with direct and easy visibility for at least three months. Within three business days after that deadline the controller must file with the ANPD a declaration that the data subjects were informed, stating the means used; including recommendations to data subjects to reverse or mitigate effects may count as good practice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.