A controller may transfer personal data to a foreign state only if that state ensures a sufficient level of protection of privacy and fundamental rights and freedoms, assessed in particular by its laws, security measures, the characteristics of the processing such as purpose and duration, and the nature, origin and destination of the data; the CNDP establishes the list of such states. Transfer applications state the sender, recipient, file, categories of data, data subjects and approximate number, recipient's purpose, mode and frequency, and first transfer date, and group or multi-recipient transfers of the same data for the same purposes may be covered by one declaration; changes must be notified within eight working days (Decree Articles 46, 49 and 50). Transferring in breach of Articles 43 and 44 is an offence (Article 60).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.