Without adequate protection, personal data may leave the State only: to companies in countries without data protection law under a contract or agreement binding them to the Decree-Law's measures, controls and requirements, including measures imposed by a judicial or regulatory authority there as set in the contract; with the data subject's explicit consent, provided the transfer does not conflict with the State's public or security interest; where needed to meet obligations or establish, exercise or defend rights before judicial bodies; to conclude or perform a contract between the controller and the data subject, or with a third party in the data subject's interest; for international judicial cooperation; or to protect the public interest. The controls to observe are left to the Executive Regulations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.