Every data controller belonging to a class for which a code of practice is registered (by a data controller forum under s. 23 or issued by the Commissioner under s. 24; codes are registered for sectors such as banking and financial institutions, insurance and takaful, communications, utilities, private hospitals and aviation, with a General Code of Practice) must comply with it; non-compliance is an offence (fine up to RM100,000, imprisonment up to one year or both). Where it is unclear which code applies, the controller may ask the Commissioner for an opinion, given within 30 days.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.