Where a breach is likely to result in a high risk to individuals the controller must tell the data subjects without undue delay, in clear and plain language, with the nature of the breach, the contact point, likely consequences and measures taken. This is not required if the data were rendered unintelligible (for example encrypted), if later measures mean the high risk is no longer likely, or if it would involve disproportionate effort, in which case a public communication must be made instead. The Commissioner may require communication.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.