On detecting a breach of the personal data protection regulation the controller or controlling and processing entity must notify the Ministry of Public Security (A05) on Form 03 not later than 72 hours after the breach is committed, giving reasons where notification is late; the processor must notify the controller without undue delay after becoming aware of a breach; the notification must describe the nature of the breach (time, place, acts, parties, categories and number of data), give the contact details of the assigned protection officer or organization, describe the likely consequences and damages, and describe the proposed remedial and mitigating measures, and may be given in phases where full information is not available; the controller must make records confirming the breach and coordinate with A05 in handling it; and organizations and individuals must notify A05 on detecting a breach of the law on personal data, processing for wrong purposes or contrary to the original agreement, failure to guarantee data subjects' rights, and other cases the law prescribes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.