A transfer to a state without sufficient protection is allowed only with the data subject's express consent, or where necessary to save the person's life, preserve the public interest, establish, exercise or defend legal rights, perform a contract with the data subject or pre-contractual steps at his or her request, conclude or perform a contract in his or her interest with a third party, execute international mutual legal assistance, or prevent, diagnose or treat medical conditions; or under a bilateral or multilateral agreement to which Morocco is party; or with the express, reasoned authorisation of the CNDP where the processing guarantees sufficient protection, in particular through contractual clauses or internal rules. The application must state the derogation relied on or, for an authorisation, the safeguards (Decree Articles 47 and 48).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.