For material services and those involving customer information the institution knows the city and country where its data will be hosted and makes sure that its risk assessment considers foreign authority access and requires the provider to say when it has in the past been legally compelled to hand client data to foreign authorities and where that may happen again; that the governing law and jurisdiction allow the contract to be enforced if the provider breaches it; that the data protection law of the hosting and processing jurisdiction is in line with or equivalent to Mauritian data protection law; that the foreign jurisdiction does not restrict the Bank, the institution, its external auditors or their appointees from examining onsite, auditing, exercising access rights or reaching information; that the contract lets the institution terminate if the data location changes to one it is concerned about; that authorities of the hosting, processing or provider countries do not have access to the institution's data, and where a court or regulator of competent jurisdiction orders disclosure the contract obliges the provider to use reasonable efforts to notify the institution beforehand so it can seek to prevent or limit the disclosure unless such notice is prohibited, and otherwise to take appropriate legal and protective measures in the institution's interest; and that the institution informs the Bank of any such disclosure by the provider.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.