A data controller that transfers or intends to transfer personal data abroad must inform data subjects through its personal data protection notice or other written notice; remains responsible for security during transfer and must use secure transfer methods under the Security Principle and Standard; must put personal data clauses including security into contracts with third parties and processors and ensure processors comply with s. 9; and must keep records of each receiver (name, registration number, DPO or contact), destination country, data types and purposes, plus evidence for the ground used (TIA and findings, notice and consent, contract and necessity proof, BCR, certificate or signed clauses).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.