The data controller must keep, in physical and electronic form, records and a register of personal data breaches for at least two years (from the notification or the breach), including breaches that did not meet the notification criteria, recording at least the description (time of awareness, root cause, data types, numbers of data subjects and records, compromised system), likely consequences, chronology, containment and recovery measures, and the notifications made or the reasons for not notifying; the Commissioner may require the records under s. 121.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.