Taking into account its liabilities under the Law, the controller is forbidden from taking any decision or measure that limits cross-border data flows unless the processing of the data is in breach of the Law or may cause serious damage to the personal data or the individual's privacy; cross-border transfers therefore require the controller to assess that the receiving processing is lawful and not seriously harmful rather than to obtain approval. Violations carry a fine of up to QAR 1,000,000 (article 23).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.