Where a breach is likely to result in a high risk to individuals the controller must inform the data subject without undue delay with the nature of the breach, contact point, likely consequences and measures, unless protective measures such as encryption applied, later measures removed the high risk, or it would involve disproportionate effort (then a public communication); it may restrict the communication where necessary and proportionate to avoid obstructing inquiries, prejudicing crime prevention, protecting public security or protecting others' rights. The Commissioner may require communication.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.