Where a personal data breach occurs in respect of personal data stored or processed by a data processor, the processor on becoming aware notifies the data controller or the processor that engaged it, describing the nature of the breach including where possible the categories and approximate numbers of data subjects and records concerned, and responds to all information requests the engaging party requires to meet its own section 40 obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.