In force: where an agency's breach of the Act leads to theft, leakage, tampering with or other infringement of personal data, it must investigate and notify the data subjects promptly by any means that lets them know (or by internet, media or other public means where individual notice would be excessively costly), stating the facts and the measures taken (ER 22). Promulgated 11 November 2025 but not yet in force: once it becomes aware of theft, tampering, damage, loss or leakage of data it holds, an agency must notify the data subjects; above a set threshold it must also report to the Personal Data Protection Commission (and, for government agencies, to their supervising body, and for non-government agencies the Commission informs the sector regulator); and it must take immediate effective response measures and record the facts, impact and actions for inspection, with content, form, deadlines and thresholds to be set by the Commission.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.