Per PDPA Singapore Transfer Limitation Obligation + Data Intermediary provisions: cross-border + processor management. Requirements include (a) implement Transfer Limitation Obligation - personal data must not be transferred outside Singapore unless requirements ensuring comparable protection are met (per Transfer Regulations) + (b) implement Cross-Border Transfer Safeguards including data transfer agreements + binding corporate rules + certifications + (c) implement Data Intermediary Oversight - principal organisation remains accountable when using a data intermediary for processing + (d) maintain Data Processing Agreements ensuring processors process only on instructions + maintain security + assist with obligations + (e) maintain inventory of cross-border data flows + recipients + safeguards + (f) implement supplier + processor + sub-processor due diligence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.