A controller that intends to transfer data to national or foreign third parties other than a processor must communicate the privacy notice and the purposes to which the data subject limited processing; processing follows the notice, which contains a clause stating whether the data subject accepts the transfer, and the recipient assumes the same obligations as the transferring controller. Transfers may be made without consent where provided by a law or treaty to which Mexico is party, necessary for medical prevention, diagnosis, care or health service management, made to holding, subsidiary or affiliated companies under common control or the same group operating under the same internal processes and policies, necessary under a contract in the data subject's interest, necessary or legally required for public interest or justice, needed to establish, exercise or defend a right in court, or needed to maintain or fulfil a legal relationship with the data subject.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.