No formal PDPA ownership or accountability

Policies exist but ownership is unclear or inactive

Defined roles with regular governance oversight

Embedded governance with continuous monitoring and reporting