A provider of publicly available electronic communications services must notify a personal data breach to the Commissioner without undue delay, with its nature, contact points, consequences and measures taken or proposed (under Commission Regulation (EU) No 611/2013), and, where the breach is likely to adversely affect subscribers' or individuals' personal data or privacy, notify them without undue delay with the nature of the breach, contact points and recommended mitigation, unless it shows the Commissioner the data was rendered unintelligible by applied technological protection; the Commissioner may require notification. Providers keep an inventory of breaches (facts, effects, remedial action) sufficient for the Commissioner to verify compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.