Article 52: a controller notifies the Commissioner of a personal data breach that may result in a risk to individuals' rights without undue delay and where possible within 72 hours of becoming aware, explaining any delay; the processor informs the controller without undue delay; the notice describes the nature of the breach, categories and approximate numbers of persons and records, the DPO or other contact, likely consequences and measures taken or proposed, and may be phased; every breach is documented so the Commissioner can check compliance; the Commissioner prescribes the notification form.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.