Where there are reasonable grounds to believe that a data subject's personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Regulator and, unless the data subject's identity cannot be established, the data subject, as soon as reasonably possible after discovery, taking into account the legitimate needs of law enforcement and measures reasonably necessary to determine the scope of the compromise and restore the integrity of its information system; notification of the data subject may be delayed only where a law enforcement body or the Regulator determines it would impede a criminal investigation; the data subject notification must be in writing by post, e-mail, a prominent website position, the news media or as the Regulator directs, and must give sufficient information to take protective measures: the possible consequences, the measures taken or intended, recommended mitigation by the data subject and, if known, the identity of the unauthorised person; the Regulator may direct publicity. The Regulator's section 22 form and guideline prescribe the notification's content, submitted through its e-services portal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.