Without meeting subsection (1), a transfer may still take place with the data subject's explicit consent after being told the risks, where necessary for a contract with them or pre-contract steps, for legal claims, for Schedule I public interest reasons, for an emergency threatening life, health or safety where consent cannot be given, where data merely transits Sri Lanka, or under other prescribed conditions. A public authority may not transfer categories of data the Minister prescribes on request of the Authority or the public authority after consulting the relevant regulator.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.