Govern cross-border transfers under Section 36 particularly significant due to Mauritius as cross-border financial services hub. Section 36 transfers prohibited outside Mauritius unless: (a) adequacy decision by Data Protection Commissioner; (b) Standard Contractual Clauses (SCC) approved by Commissioner; (c) Binding Corporate Rules (BCR) approved by Commissioner; (d) explicit consent after being informed of risks; (e) necessary for performance of contract; (f) necessary for important public interest; (g) necessary for establishment exercise or defence of legal claims; (h) necessary for vital interests; (i) made from public register. Adequacy decisions issued by Commissioner via Government Notices. Convention 108+ member states automatic adequacy. EU GDPR adequacy assessment ongoing. Mauritius as Mauritius International Business Companies (IBC) + Mauritius Global Business Companies (GBC) jurisdiction makes cross-border transfers central to economic model - offshore banking + investment management + insurance + global headquarters services + double-taxation treaty network with India + China + South Africa + Madagascar + others requires data flows. FSC Conduct of Business Rules + BoM Guidelines on outsourcing intersect with Section 36. EU-Mauritius Economic Partnership Agreement (EPA) + Mauritius-India CECPA data flow provisions + AfCFTA Digital Protocol participation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.