Articles 87 and 95: fines must be effective, proportionate and dissuasive and weigh nature, gravity, duration, intent, mitigation, responsibility given Articles 42 and 50, history, cooperation, data types, how the Commissioner learned of the breach, compliance with earlier orders, codes or certification and financial gain; a legal-entity controller or processor is fined 50,000 to 2,000,000 dinars for 32 listed breaches (principles, purposes, consent proof, special and criminal data, information, access, rectification, erasure, restriction, objection, automated decisions, security, joint controllers, processors, breach notification and communication, DPIA, prior consultation, DPO, transfers, research safeguards); 100,000 dinars for failing to name a representative, keep records, publish DPO contacts, inform recipients or stop direct marketing after objection; entrepreneurs 20,000 to 500,000 dinars; responsible individuals and staff breaching professional secrecy 5,000 to 150,000 dinars.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.