Controllers and processors may transfer personal information outside Tonga only with the Commission's written consent or where the recipient is bound by a law, binding corporate rules, contractual clauses, code of conduct or certification giving protection substantially similar to the Act (including onward transfers), as designated or approved by the Commission; otherwise only on informed consent to the risks, necessity for a contract with or requested by the data subject, benefit to a data subject whose consent is impracticable but likely, a Part V exemption, or Commission-approved safeguards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.