The authority (currently the sector regulator; the Commission once the 2025 text is in force) may restrict a non-government agency's international transfer where major national interests are involved, a treaty or agreement so provides, the recipient country lacks sound data protection law so that the person's rights may be harmed, or the transfer routes data through a third country to evade the Act. Restrictions take the form of orders or dispositions by the authority, whose breach is fined and, with intent to gain or harm, is an offence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.