16 Laws of Malaysia ACT 709 (d) an enforcement notice, means the data user on whom the enforcement notice is served; “credit reporting business” has the meaning assigned to it in the Credit Reporting Agencies Act 2010; “Commissioner” means the Personal Data Protection Commissioner appointed under section 47; “third party”, in relation to personal data, means any person other than— (a) a data subject; (b) a relevant person in relation to a data subject; (c) a data user; (d) a data processor; or (e) a person authorized in writing by the data user to process the personal data under the direct control of the data user; “relevant filing system” means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set of information is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible; “data subject” means an individual who is the subject of the personal data; “appointed date” means the relevant date or dates, as the case may be, on which this Act comes into operation; “code of practice” means the personal data protection code of practice in respect of a specific class of data users registered by the Commissioner pursuant to section 23 or issued by the Commissioner under section 24; “commercial transactions” means any transaction of a commercial nature, whether contractual or not, which includes any matters relating to the supply or exchange of goods or services, agency,