Notwithstanding s. 129(2), a transfer is allowed where the data subject consented (after a notice naming the classes of recipients and purpose, with consent recorded); it is necessary for a contract with the data subject, or for concluding or performing a contract with a third party made at the data subject's request or in their clear, direct and targeted interest (necessity meaning a specific purpose with no feasible cheaper alternative, not routine practice); it is for legal proceedings, legal advice or legal rights (not merely possible future proceedings); the controller reasonably believes it avoids adverse action, consent is impracticable and would have been given; the controller has taken all reasonable precautions and exercised all due diligence that the data will not be processed in a way that would breach the Act, shown by binding corporate rules with the fifteen listed elements, contractual clauses (for example the ASEAN Model Contractual Clauses or EU SCCs, reviewed for gaps) or a recognised certificate verified and warranted by contract, and suspends transfers on a breach until remedied; or it is necessary to protect the data subject's vital interests. The public-interest ground was repealed on 1 April 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.