Before processing, the responsible party must obtain the Regulator's prior authorisation, by notifying the processing, where it plans to process unique identifiers for a purpose other than that intended at collection and to link them with information processed by other responsible parties; process information on criminal behaviour or unlawful or objectionable conduct on behalf of third parties; process information for credit reporting; or transfer special personal information or children's information to a third party in a foreign country without adequate protection; notified processing may not be carried out until the Regulator has completed its investigation or given notice that it will not investigate further (in force from 1 February 2022), the Regulator having four weeks to decide and up to thirteen weeks to investigate, silence allowing the responsible party to proceed; authorisation is obtained once unless the processing departs from what was authorised, and is not required where an approved code of conduct covers the sector. Failure to notify is an offence (59).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.