Article 28-8 (2023 amendment): transferring personal information abroad (provision including remote viewing, outsourcing or storage) is prohibited unless there is separate consent after notice of items, country, timing and method, recipient, its purpose and retention, and how to refuse; a law or treaty specially provides; outsourcing or storage is needed to conclude or perform a contract and the details are disclosed in the privacy policy or notified; the recipient holds a Commission-recognised certification and takes safeguards and steps to implement it in the destination; or the Commission recognises the destination country or organisation as substantially equivalent; the transferring controller must also meet the Act's other duties and decree safeguards and may not sign transfer contracts that breach the Act; onward transfers follow the same rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.