A public body may transfer data to another public body where needed for either body's tasks and s 23 would permit the processing; the recipient uses the data only for the transfer purpose, other uses requiring s 23 grounds. Transfer to a private body is allowed where needed for the transferring body's tasks under s 23 conditions, where the recipient credibly shows a legitimate interest and the data subject has no legitimate interest in exclusion, or for legal claims; the recipient must undertake to use the data only for that purpose, and other uses need the transferring body's consent. Special categories additionally need a GDPR Art. 9(2) or s 22 exception.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.