A Controller exempt from the adequacy or minimum-data conditions must use appropriate safeguards: standard contractual clauses, binding common rules or an accreditation certificate. Exemption cases: transfers between public bodies under an agreement to which the Kingdom is party or serving its interests (standard data protection provisions in the agreement or memorandum); non-recurring or limited transfers of few data subjects (standard contractual clauses, or a recipient holding an approval certificate from a licensed body, non-sensitive data only); central operations within a multinational group (binding common rules or standard contractual clauses, or a certified recipient); providing a service or benefit directly to the data subject without breaching expectations (certified recipient, non-sensitive data); scientific research (minimum data, clauses or certified recipient, non-sensitive data). Safeguards must secure compliance and data subjects' rights including complaint and compensation; the Authority may review them every two years (Transfer Regulation 4). SDAIA's Standard Contractual Clauses and Binding Common Rules guidelines (September 2024) are the models.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.