In meeting its responsibilities an organisation must consider what a reasonable person would consider appropriate in the circumstances; it is responsible for personal data in its possession or under its control; it must designate one or more individuals (the data protection officer, who may delegate) responsible for ensuring compliance, and make the business contact information of at least one of them available to the public, which since 2020 is satisfied by providing it in the prescribed manner (the ACRA BizFile+ register); designation does not relieve the organisation of its obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.