For transfer, storage, sharing, processing or making available abroad the controller or processor holds a licence or permit granted on the Centre's assessment of the destination's adequacy; obtains the data subject's consent to the transfer; uses technologies that guarantee adequate protection during transfer, handling, sharing and storage, proportionate to the licensed volume and nature; and transfers only to the countries named in the licence or permit, updating it before adding any country; the Centre lists adequate countries by the existence of consistent data protection legislation, technical and security measures and compensation rules, reviewed periodically, and may license transfers to other countries meeting the same standards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.