A controller or processor may transfer personal data out of Sri Lanka only if it ensures continued compliance with Parts I and II and sections 20 to 25, adopting the instruments the Authority specifies by directive to secure binding and enforceable commitments by the recipient, with appropriate safeguards and remedies. The adequacy-decision model of the 2022 text was removed. A DPA draft directive (2024) lists binding corporate rules, agreements, codes of conduct, certification and other instruments.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.