Global corporate rules may be used only for transfers between members of the same group or conglomerate that subscribe to them, and only to the organisations or countries they cover. They must be tied to a privacy governance programme meeting Art. 50 paragraph 2, and contain at least: a description of the transfers (data categories, operations, purposes, legal basis, types of data subjects); the destination countries; the group structure with each entity's role and contacts; their binding nature on members and employees; allocation of responsibility with a responsible entity in Brazil answering for any member's breach; the applicable data subject rights and channels, including petition to the ANPD; review rules subject to prior ANPD approval; and a duty to inform the ANPD of changes to the guarantees, including immediate notice to the responsible entity when a member abroad is subject to a legal order preventing compliance. The rules need ANPD approval before use, and later changes need prior approval.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.