Every data controller must appoint a DPO and notify the Authority on Form DP2, within 90 days of promulgation or of a previous DPO's contract ending; changes to the DPO's contact details and a DPO's dismissal or resignation must be notified within 14 days. Failure to appoint is an offence punishable by a fine up to level 7 or up to two years' imprisonment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.