A controller must tell the Authority of a personal data breach no later than 24 hours after learning of it, on Form DP3; where a breach is likely to result in high risk to individuals' rights and freedoms, affected data subjects are informed within 72 hours. Controllers maintain breach detection, investigation and internal reporting procedures, keep a record of all breaches, cooperate with the Authority, answer its information requests within 14 days, and submit an investigation report within 21 days of notification. Contravention is an offence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.