Responsible parties and processors must adopt the technical and organisational measures needed to preserve the integrity, confidentiality and availability of information, considering national and international standards such as AGESIC's Cybersecurity Framework, and on confirming a security incident causing accidental or unlawful disclosure, destruction, loss or alteration of personal data or unauthorised communication or access, must start the procedures to minimise its impact within the first 24 hours (D.3); the responsible party must communicate a security breach affecting data protection to the URCDP within 72 hours of learning of it, with relevant information such as the certain or estimated date, its nature, the data affected and the possible impacts; a processor that learns of a breach must communicate it immediately to the responsible party; the responsible party must communicate the breach in clear and simple language to data subjects whose rights are significantly affected; and once resolved must draw up a detailed report on the breach and the measures adopted and send it to the URCDP (D.4). This implements article 38 of Ley 19.670, which requires immediate and detailed information to data subjects and the URCDP, which coordinates with CERTuy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.