The controller must notify the Office of any personal data breach without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to persons' rights and freedoms. Where the breach is likely to result in a high risk, the controller must also notify the data subjects of the breach and the remedial measures without delay. Notification and its exemptions follow the Committee's rules (the December 2022 breach notification notification).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.