A registered data controller must apply for renewal not later than 90 days before the certificate expires (no renewal is allowed after expiry; continuing to process on an expired certificate is an offence under regulation 5(2) of P.U. (A) 337/2013, fine up to RM250,000 or two years); the Commissioner may attach or vary conditions and may refuse renewal or revoke registration for non-compliance, breach of conditions or false representation. After revocation the controller must stop processing (offence up to RM500,000 or three years) and surrender the certificate within 7 days of the revocation notice (offence up to RM200,000 or two years).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.