A data controller may process sensitive personal data (health, political opinions, religious or similar beliefs, offences, and biometric data) only with the data subject's explicit consent, where necessary for an employment-law right or obligation, to protect vital interests where consent cannot be given or obtained or is unreasonably withheld for another's vital interests, for medical purposes by a healthcare professional or someone under an equivalent duty of confidentiality, for legal proceedings, legal advice or legal rights, for the administration of justice, for statutory functions, for other purposes the Minister thinks fit, or where the data subject deliberately made the information public. Breach is an offence (fine up to RM200,000, imprisonment up to two years or both).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.