Schedule 1 Part 8 makes it a civil penalty provision (maximum 200 penalty units, infringement notice available) for an entity to prepare a statement under s 26WK that does not comply with s 26WK(3): the statement must set out the entity's identity and contact details, a description of the eligible data breach, the kinds of information concerned, and recommendations about the steps individuals should take in response.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.