Without an adequacy decision, a controller or processor may transfer only with appropriate safeguards and enforceable rights and effective remedies for data subjects. Without specific Agency authorisation the safeguards may be a binding instrument between public authorities, binding corporate rules, or an approved code of conduct or certification mechanism with binding commitments of the importer; standard clauses adopted by the European Commission, or adopted by the Agency and approved by the Commission, are also listed but apply only from Montenegro's accession to the European Union (Article 104). With Agency authorisation the safeguards may be contractual clauses between exporter and importer or provisions in administrative arrangements between public authorities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.