Personal data may be sent or transferred to a foreign country or international organisation only if the destination has an adequate standard of data protection and the transfer follows the Committee's rules under section 16(5), unless the transfer (1) complies with law; (2) has the data subject's consent after being told the destination's standard is inadequate; (3) is necessary to perform a contract with the data subject or pre-contract steps at their request; (4) complies with a contract between the controller and another person for the data subject's benefit; (5) prevents or suppresses a danger to the life, body or health of the data subject or another person when the data subject cannot consent; or (6) is necessary for activities of substantial public interest. Questions on a destination's adequacy go to the Committee, whose decision may be reviewed on new evidence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.