Security breaches at any stage of processing that significantly affect data subjects' property or moral rights must be reported to them by the controller immediately so they can take measures to defend their rights. The Law sets no notification to the authority.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.