Without adequacy, a controller or processor may transfer only with appropriate safeguards and enforceable data subject rights and remedies. Safeguards needing no specific authorisation are a binding instrument between public bodies, binding company rules approved by the Commissioner, standard data protection clauses published by the Commissioner, or an approved code of conduct or certification with binding commitments of the recipient. Contractual clauses between exporter and recipient, and administrative arrangements between public bodies, need the Commissioner's authorisation. Failing these, a transfer may take place only on informed and explicit consent after being told of the risks, for a contract with or in the interest of the data subject, vital interests where consent cannot be given, important public interest, legal claims, or from a public register (not whole sections). As a last resort a non-repetitive transfer of limited data subjects for compelling legitimate interests not overridden by their rights is allowed after the controller assesses the circumstances and adopts safeguards, informs the Commissioner and tells the data subjects. Public authorities exercising public powers cannot use consent, contract or the last-resort ground.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.