Defines a personal data breach as a breach of security measures, from intent, negligence, unauthorised or unlawful action, computer offence, cyber threat, error, accident or other cause, leading to unauthorised or unlawful loss, access, use, alteration or disclosure; covers confidentiality, integrity and availability breaches caused by the controller, its processor or their staff and agents. On learning of a breach the controller assesses the information's credibility and the risk, contains the breach promptly where high risk, notifies the Office within 72 hours unless there is no risk, and notifies affected data subjects without delay where the risk is high, then takes measures to stop recurrence and reviews security. The Office notice covers the nature and number of data subjects and records, DPO or contact details, likely consequences and measures taken; data subject notices cover a brief description, contact point, likely consequences and remedies with steps they can take. A request for relief from late notice must reach the Office within 15 days of awareness. Controllers must contractually require processors to report breaches, where feasible within 72 hours.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.