The owner and the processor carry out a cross-border flow of personal data only if the destination country maintains adequate levels of protection under the Law; where it does not, the sender guarantees that the processing is carried out in accordance with the Law (by contractual clauses, binding corporate rules or other instruments the Reglamento accepts), except in the listed cases: agreements under international treaties to which Peru is party; international judicial cooperation; cooperation between intelligence bodies against terrorism, drug trafficking, money laundering, corruption, human trafficking and organised crime; data necessary for the performance of a contract with the data subject including user authentication, service improvement and support, quality monitoring, account maintenance and billing; bank and stock-exchange transfers for the respective transactions; medical or surgical protection, prevention, diagnosis or treatment of the data subject or epidemiological studies under dissociation; the data subject's prior, informed, express and unequivocal consent; and others the Reglamento establishes. Cross-border flows are communicated to the National Registry (article 34(2); Reglamento articles 12 to 21, which set the guarantees and the Authority's opinion and registration).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.