The controller must notify a personal data breach to the Commissioner without undue delay and where feasible within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals, giving reasons for any delay. The notification must describe the nature of the breach with categories and approximate numbers of data subjects and records, the DPO or other contact, the likely consequences and the measures taken or proposed, and may be provided in phases. Processors must notify the controller without undue delay. Every breach must be documented (facts, effects, remedial action) so the Commissioner can verify compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.