A controller aware of a personal data breach must notify the Commissioner without undue delay and where feasible within 72 hours, unless it is unlikely to result in a risk to individuals, giving reasons for delay, describing the breach, numbers of data subjects and records, the contact point, likely consequences and measures taken, in phases if necessary; it must record the facts, effects and remedial action so the Commissioner can verify compliance; processors must notify the controller without undue delay.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.