Anyone who determines the purposes and means of processing, decides what personal data to collect or from whom, or gains commercially from processing must hold a data controller licence from the Authority, applying on Form DP1 with the prescribed fee; the Authority decides within 14 days and may attach conditions. Controllers existing at promulgation (13 September 2024) had six months to apply. Processing without a licence after that period, or giving false information in an application (r.7), is an offence punishable by a fine up to level 11 or up to seven years' imprisonment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.