Once in force, each agency must report annually on its data protection management to its superior or supervising body (or, for the Presidential Office, National Security Council, the five Yuan, and municipal and county governments and councils, to the Commission), superior agencies must supervise and audit subordinate bodies and collect improvement reports, the Commission will audit agencies regularly or ad hoc and may inspect on site where a breach is suspected, and it may order correction by a deadline and publish the names of agencies that do not comply; staff at fault face discipline. Intelligence agencies are excluded.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.