Where a breach is likely to result in a high risk to data subjects' rights and freedoms, the controller, after notifying the Commissioner, must communicate it to the data subjects without undue delay in clear language, describing its nature and giving the section 25 information and recommendations. Communication is not required where the affected data were rendered unintelligible (for example by encryption), subsequent measures mean the high risk is no longer likely, or individual contact would be disproportionate and an equally effective public communication is made; the Commissioner may require communication.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.