A controller or processor must designate or appoint a DPO where processing is carried out by a Ministry or government department (public corporations were removed by the 2025 Act; the judiciary acting judicially is excluded), or where its core activities involve regular and systematic monitoring or special category processing on a prescribed scale, or categories of processing that create a risk of harm to data subjects' rights as the Authority sets by guidelines. The 2025 Act allows the DPO to be an outsourced third party performing the section 20(5) duties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.