In case of a personal data breach the controller must communicate the breach to the supervisory authority within forty-eight hours of becoming aware of the incident; a processor that becomes aware of a breach must notify the controller within forty-eight hours of becoming aware. Failure to notify is an administrative misconduct. The NCSA publishes a breach notification form (not held).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.