A controller or processor may transfer personal data to another country only where it has given the Commissioner proof of appropriate safeguards; the data subject gave explicit consent after being informed of the risks of the absence of safeguards; the transfer is necessary for a contract with or in the interest of the data subject, pre-contract measures, public interest provided by law, legal claims, or the vital interests of a person incapable of consenting; for compelling legitimate interests not overridden by data subjects' rights where the transfer is not repetitive, concerns a limited number of data subjects and the controller has assessed the circumstances and given the Commissioner proof of safeguards; or from a public register within its consultation conditions (never the whole register or entire categories). The contract, legitimate-interest and safeguards grounds do not apply to public authorities exercising their functions. The Commissioner may require the effectiveness of safeguards to be demonstrated and may prohibit, suspend or condition a transfer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.