Data may not be transferred to any person outside the Kingdom, including a recipient, whose level of protection is lower than the Law's, except for regional or international judicial cooperation under agreements in force; cooperation with international or regional bodies fighting crime and pursuing offenders; exchange of a data subject's medical data needed for treatment; exchange of data on epidemics, health disasters or public health matters in the Kingdom; the data subject's consent after being told that adequate protection is lacking; or banking operations and transfers of funds abroad. The Council issues and updates a list of countries and bodies with a sufficient level of protection (Article 17(H)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.