The controller must inform the individual and the Competent Department (now the National Data Privacy Office of the NCSA) of the occurrence of any breach of the article 13 precautions where the breach may cause serious damage to the personal data or the individual's privacy; the NCGAA breach notification guidelines, as reported in the practice guides, expect notification within 72 hours.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.