No one may send, or have sent, a commercial electronic message with an Australian link (other than a designated message) unless it carries a statement, presented clearly and conspicuously, telling the recipient they can opt out by messaging an electronic address shown in the message, which reaches the authorising individual or organisation (an unsubscribe message says the account-holder wants no further commercial messages from or authorised by that sender). The address must be reasonably likely to receive the recipient's unsubscribe message and a reasonable number of others at all times for at least 30 days after the message is sent, must be legitimately obtained, and must meet the conditions in the Spam Regulations 2021 (s 7: no premium service, no more than usual cost, no fee, no personal information beyond the address, no login or account). The rule yields to the extent it conflicts with a contract or agreement between the authoriser and the account-holder; the Australian link and mistake exceptions also apply, each with the evidential burden on the sender. Civil penalty provision (lower tier).
This control maps to 3 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.