A controller or processor may share or transfer personal data to a third party outside Rwanda only where it has obtained the supervisory authority's authorisation after proving appropriate safeguards; the data subject has consented; or the transfer is necessary for a contract with the data subject or pre-contractual measures, a contract in the data subject's interest with a third party, public interest grounds, legal claims, the vital interests of a data subject incapable of consenting, compelling legitimate interests not overridden by the data subject's rights where the transfer is not repetitive, concerns a limited number of data subjects and follows an assessment with suitable safeguards, or the performance of international instruments ratified by Rwanda; the authority may add grounds by regulation, may require the controller or processor to demonstrate compliance, and may prohibit or suspend transfers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.