Before transferring or disclosing data abroad under an exemption (Transfer Regulation 4), or transferring sensitive data continuously or widely, the Controller conducts a risk assessment covering the purpose and legal basis, the nature of the transfer, processing activities and geography, the safeguards and their adequacy, minimisation measures where not exempt, potential material or moral effects and their likelihood, and preventive and mitigating measures (Transfer Regulation 7); SDAIA's Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom (February 2025) sets the method.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.