A controller or processor that authorises a person to access, share or transfer personal data to a third party outside Rwanda must enter into a written contract with that person setting out the parties' roles and responsibilities to ensure compliance with the Law; the authority may prescribe the form; the authorisation, contract-necessity and legal-claim grounds of article 48 do not apply to a public body exercising its functions; and the authority may require the controller or processor to demonstrate compliance, in particular with security safeguards and the legitimate-interest conditions. See the official text for the full requirement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.