A data controller in a class specified by ministerial order (the Personal Data Protection (Class of Data Users) Order 2013, P.U. (A) 336, as amended 2016, P.U. (A) 326: communications and postal licensees, banking and financial institutions, insurance and takaful, private healthcare, tourism and hospitality, named airlines, private education, direct selling, services (legal, audit, accountancy, engineering and architecture firms, retail and wholesale businesses, private employment agencies), licensed housing developers, named electricity and water utilities, and, from 16 December 2016, pawnbrokers and moneylenders) must apply to the Commissioner for registration with the prescribed fee before processing; processing without a certificate is an offence (fine up to RM500,000, imprisonment up to three years or both). Under Circular 1/2026 (in force 1 June 2026) applications go online through SPDP per licence issued by the sector regulator (except the services class), with supporting documents, an annual fee of RM100 to RM400 by business form for a certificate valid one to five years, and the certificate displayed conspicuously at the principal place of business.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.