The initial notification to the NDPC and NITDA contains at least, as the NDPA's general application and implementation directive requires, an account of what happened and what kind of breach it was, with the data categories and the approximate numbers of data subjects and records; when the breach happened or over what period; how likely it is to harm individuals; what has been or will be done to deal with it and soften its effects; and the name and contact details of the data protection officer or other contact who can give further information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.