A data controller notifies the Commission within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals and, where feasible, describes the nature of the breach including the categories and approximate numbers of data subjects and personal data records concerned; information not available at once may be provided in phases without undue delay (40(9)); the likelihood of risk may be judged on the effectiveness of technical and administrative measures such as encryption or de-identification, subsequent mitigation, and the nature, scope and sensitivity of the data (40(7)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.