Where personal data is believed to have been accessed or acquired by an unauthorised person, the collector, processor or controller notifies the Authority immediately (Form 7) with the nature of the breach, the data affected, categories and approximate number of data subjects, likely consequences, remedial measures and the DPO's contact; it notifies data subjects and the public as the Office directs, by the prescribed means, with enough information for them to protect themselves.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.