A Controller may transfer data outside the Kingdom or disclose it to a party abroad to perform an obligation under an agreement to which the Kingdom is party, to serve the Kingdom's interests, to perform an obligation to which the data subject is party, or for other purposes in the Regulations (Law 29(1)): central processing operations needed for the Controller's activities, providing a service or benefit to the data subject, or scientific research and studies (Transfer Regulation 2). The transfer must not prejudice national security or vital interests, there must be adequate protection at least equal to the Law according to the Authority's assessment, and the data must be the minimum needed (Law 29(2)); these conditions do not apply in extreme necessity to preserve life or vital interests or to prevent, examine or treat disease (Law 29(3)). The Authority publishes and reviews every four years a list of countries and international organisations with adequate protection, assessed on data protection laws including compensation rights, a supervisory authority, cooperation, disclosure rules, international obligations and onward transfer, and may suspend transfers (Transfer Regulation 3). The Law and Regulations apply to onward transfers (Transfer Regulation 5).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.