Transfers to countries without adequate protection need adequacy judged on the circumstances or a listed derogation (consent, contract, public interest or legal claims, the subject's interests, public registers) or Commission authorisation on adequate safeguards; the regulations require a controller or processor intending any transfer abroad to apply on Form No. 7 with the recipient, data, purpose, security in the recipient country, the subject's consent and proof of a treaty, bilateral agreement or contract, and to keep to the permit: named recipient only, stated purpose only, no onward transfer without approval.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.