A controller or processor has an affirmative defense if it creates, maintains and complies with a written privacy policy that reasonably conforms to the NIST Privacy Framework Version 1.0 (or other documented policies, standards and procedures designed to safeguard consumer privacy), is updated to conform to a later revision within two years of its publication, and gives people the Act's substantive rights; the programme's scale is judged on business size and complexity, activities, data sensitivity, cost of tools and compliance with comparable laws, and APEC CBPR or PRP certification can be considered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.