Where processed data are obtained by others unlawfully, the controller must notify the data subject and the Board within the shortest time, and the Board may announce the breach on its website or otherwise. The Board reads the shortest time as 72 hours from awareness, with reasons for any delay attached, and data subjects notified as soon as reasonably possible once the affected persons are identified (Board decision 2019/10).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.