Where an organisation assesses that a breach is notifiable it must notify the Commission as soon as practicable and no later than 3 calendar days after the day it makes that assessment, and must notify, at the same time or after, each affected individual to whom significant harm results or is likely to result, in any reasonable manner; notifications carry the prescribed information (nature, categories and volume of data, cause, potential harm, remedial and mitigation actions, contact details) in the form the Commission requires; notification of individuals is not required where the organisation has taken action rendering significant harm unlikely or had implemented technological measures (such as encryption) that do so, and is prohibited where a law enforcement agency instructs or the Commission directs, or waived on application; notification does not breach confidentiality duties and does not displace notification duties under other laws.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.