On a personal data breach the controller must notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of it, giving reasons for any delay. A processor that becomes aware of a breach notifies the controller without undue delay. The notification describes the nature of the breach including, where possible, the categories and approximate numbers of data subjects and records, the name and contact details of the data protection officer or other contact point, and recommended measures to address and mitigate the breach; the controller documents the facts, effects and remedial action so the Commissioner can verify compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.