Consent must be obtained in a form that can be recorded and properly maintained; where the consent form also covers another matter, the consent request must be presented so it is distinguishable in appearance; for a data subject under 18, consent comes from the parent, guardian or person with parental responsibility; for one unable to manage their affairs, from a court-appointed person or a written authorised representative; and the burden of proving consent lies on the data controller. Breach of regulation 3(1) is an offence (fine up to RM250,000, imprisonment up to two years or both).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.