Controllers notify the Data Protection Authority within 24 hours of any security breach affecting data they process; S.I. 155 of 2024 adds the notification form, notice to affected data subjects and investigation timelines (see regulation 17).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.