Per POPIA Sections 69 + 72: transfer + marketing. Requirements include (a) implement Transborder Flows (Section 72) restrictions - personal information may be transferred outside South Africa only where (i) third party subject to law or binding corporate rules providing equivalent protection + (ii) data subject consents + (iii) transfer necessary for contract performance + (iv) transfer for benefit of data subject + (b) maintain documentation of cross-border data flows + safeguards + (c) implement Direct Marketing (Section 69) restrictions - direct marketing by means of unsolicited electronic communications prohibited except where data subject has consented + is a customer of the responsible party + (d) implement opt-out mechanisms + (e) maintain inventory of transfers + (f) cooperate with Information Regulator on transfer matters.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.