If all other conditions are met, data may be transferred to third-country bodies or international organisations responsible for s 45 purposes where an adequacy decision of the Commission under Directive Art. 36(3) exists; even then not where appropriate handling in line with data protection and human rights cannot be ensured in the individual case or other overriding legitimate interests of the data subject conflict. Data received from another member state need that state's prior authorisation, save for immediate serious threats (with the authority informed without delay). The controller ensures the recipient transfers onward only with its prior authorisation, which it grants only where a direct transfer would be lawful, considering the seriousness of the offence, the original purpose and the protection level.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.