Recognising that each Party may have its own measures on the use or location of computing facilities, including to secure the security and confidentiality of communications, no Party may require a covered person to use or locate computing facilities in its territory as a condition for conducting business there. A Party may still adopt or maintain an inconsistent measure it considers necessary for a legitimate public policy objective (whose necessity the implementing Party decides), if not applied as arbitrary or unjustifiable discrimination or a disguised restriction on trade, or any measure it considers necessary to protect its essential security interests, which other Parties may not dispute. Cambodia, Lao PDR and Myanmar were not obliged to apply the prohibition for five years after entry into force, extendable by three years if necessary, and Viet Nam for five years. The Article does not reach non-conforming services or investment measures preserved under Article 12.3.4, nor financial institutions and suppliers, which are not covered persons.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.