Operate breach notification + records of processing + processor engagement per Oman PDPL Articles 21 + 22 + 23. Breach notification must (a) notify the MTCIT regulator (or designated supervisory authority) within 72 hours of becoming aware of personal data breach likely to result in risk to rights and freedoms per Article 21, (b) notify affected individuals without undue delay when likely to result in high risk + (c) maintain breach register with full incident details + timeline + impact + remediation + lessons learned. Records of Processing Activities (RoPA) must (a) maintain inventory of processing activities per Article 22 with content covering controller identity + purposes + categories of data + recipients + cross-border + retention + security measures, (b) update RoPA on material change + (c) make available to supervisory authority on request. Processor engagement must (a) bind processors via written contract per Article 23 specifying nature/scope/duration + categories + obligations + breach notification flow + audit rights + sub-processor approval + return/deletion at end, (b) verify processor compliance + (c) maintain processor inventory.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.