Every controller must draw up and implement a code of ethics or personal data protection policy setting the conduct to be followed in collecting and processing personal data, and submit it to the Commission for consideration and approval; the PDPC's June 2026 notice requires every institution to have an approved policy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.