A controller must notify the Authority of a personal data breach in the form, manner and time the Authority's rules set, and those rules will state when the Authority and affected data subjects are to be notified and what the notice contains. Only a 2024 draft of the rules is held (notify the Authority within 72 hours where feasible unless the risk is low, and data subjects where the risk is high); no rules are in force.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.