Personal information may be transferred from a database in Israel abroad only if the destination's law ensures protection no lower than Israeli law and meets the regulation's principles, or under a regulation 2 ground: the data subject's consent; necessity to protect health or physical integrity where consent cannot be obtained; transfer to a controlled corporation that ensures privacy protection; a recipient that contractually undertakes to comply with the conditions applying to Israeli databases with the necessary changes (which the PPA's opinion of 13 April 2026 reads as requiring purpose limitation, access, correction and confidentiality commitments and Data Security Regulations or ISO/IEC 27001 plus specified controls); and the further grounds (published information, public safety or security, legal obligation, recognised adequate countries such as EU and EEA states and Convention 108 parties).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.