Incomplete, late or defective notification to the data protection authority of information about a personal data security breach is an infraction; the Law sets no deadline, form or authority-specific procedure for the notification, so content and timing are left to the rules each enforcing authority applies (Article 26).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.