Where there is no adequacy decision and no safeguard can be provided, controllers and processors may transfer abroad only incidentally and only where the data subject explicitly consents after being told of the possible risks; the transfer is necessary for a contract with the data subject or pre-contract steps at their request; it is necessary for a contract between the controller and another person in the data subject's interest; it is necessary for an overriding public interest; it is necessary to establish, exercise or protect a right; it is necessary to protect the life or bodily integrity of a person unable to consent; or it is made from a registry open to the public or to persons with a legitimate interest, within the registry's access rules and at that person's request. The consent and the two contract grounds are not available to public bodies acting under public law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.