The controller must verify whether an operation is an international transfer (an exporter passing data to an importer abroad; data collected directly from the data subject by an agent abroad is not a transfer but may fall under the law), whether Brazilian law applies to it (processing in Brazil, offering goods or services to or processing data of people in Brazil, or data collected in Brazil; data merely transiting, or returning only to an adequate country of origin where the adequacy decision provides, are outside it), and whether it rests on a valid legal basis under Art. 7 or 11 and a valid transfer mechanism (adequacy decision, standard or specific contractual clauses or global corporate rules under the Regulation, or the other Art. 33 grounds). Transfers must serve legitimate, specific, explicit purposes made known to the data subject and be limited to the minimum data needed; the processor must supply the information the controller needs; and both must adopt effective measures, proportionate to risk and to the mechanism used, able to demonstrate compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.