Replaces the adequacy regime with transfers approved by regulations where the Secretary of State finds the destination's standard of protection is not materially lower, and requires a transferring controller relying on appropriate safeguards (standard clauses, binding corporate rules and others) to act reasonably and proportionately in concluding the data protection test is met; restates derogations and public interest restrictions; applies the same approach to law enforcement transfers; existing adequacy decisions and clauses carry over under Schedule 9 Part 2.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.