The importer may make onward transfers only where Clause 3 authorises them (or under another valid transfer mechanism), for purposes compatible with the original transfer, binding the recipient in writing to the same safeguards, and remains responsible for the recipient's irregularities. The importer must notify the exporter and the data subject of any legally binding request for access by a public authority unless the local law forbids notice, challenge unlawful requests where there are legal grounds, and keep a register of access requests (date, requester, purpose, data requested, number, measures taken). Data must be erased at the end of processing, keeping it only on the Art. 16 grounds; security measures must protect the data even after processing ends and be periodically reviewed; the importer declares it has identified no local law or practice preventing compliance and must notify the exporter immediately of any change; if the importer breaches or cannot comply, the exporter must be told at once and may suspend the transfer, require return, transfer or erasure of the data, or terminate the contract. Brazilian law governs, disputes go to Brazilian courts (or arbitration seated in Brazil), and data subjects may sue either party in Brazil, including where they live.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.