Articles 49 and 50 with Decree Articles 42 to 44: a controller may transfer data to a third country only if it ensures a sufficient level of protection, judged on security measures, the processing's purposes and duration, and the nature, origin and destination of the data; before the first transfer the controller files a declaration with the CDP giving the sender and recipient, the file, data categories, data subjects and their approximate number, the recipient's purpose, the mode and frequency and the first transfer date, updated within fifteen working days of changes (a joint declaration is possible within a group); the CDP keeps a list of countries with equivalent laws, which does not relieve the controller. Without adequacy, occasional, non-massive transfers are allowed with express consent or where necessary to save the person's life, for the public interest, for legal claims, or for a contract with the person.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.