The controller draws up a report on the personal data breach and submits it to the supervisory authority not later than seventy-two hours with all available facts, describing at least the nature of the breach including where possible the categories and approximate numbers of data subjects and records concerned; the contact details of the data protection officer or other contact point; the measures taken to address the breach including mitigation of adverse effects; the acts, consequences and rectification measures; and the controller's proposal and timeline for communicating the breach to affected data subjects, for the authority's approval. Failure to report is an administrative misconduct.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.