Where a breach is likely to result in a high risk to the data subject's rights and freedoms the controller communicates it to the data subject in writing or electronically after becoming aware, unless the controller had implemented protection measures making high risk unlikely (such as encryption), has taken measures so the high risk is no longer likely to materialise, or has informed the public in an equally effective manner; the supervisory authority may require communication where the controller has not done so. Failure to communicate is an administrative misconduct.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.