A level of protection is adequate if it upholds principles substantially similar to the Act's conditions for processing, assessed on the availability of enforceable data subject rights and administrative or judicial redress and the rule of law, any instrument between the Commission and a competent authority of the recipient jurisdiction, public authority access to personal data, the existence of an effective data protection law, the existence and functioning of an independent supervisory authority with adequate enforcement powers, and the country's international commitments and conventions and memberships; the Commission issues guidelines on the assessment, may determine that a country, region, sector or standard contractual clauses afford adequate protection, may approve binding corporate rules, codes of conduct, certification mechanisms or similar instruments, and may rely on adequacy decisions of other jurisdictions made on similar factors; the absence of a Commission determination does not imply adequacy, so a controller relying on section 41(1)(a) without one carries its own assessment against these factors.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.