The controller and the processor must each take the precautions necessary to protect personal data against loss, damage, change, disclosure, access, or inadvertent or illegal use, commensurate with the nature and importance of the data; the processor must immediately notify the controller of any breach of those precautions or any risk threatening the personal data. Violations carry a fine of up to QAR 5,000,000 (article 24).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.