A controller or processor processes or stores personal data outside Uganda only if it can show the Office that the country has protection at least equivalent to the Act (the Office gazettes adequate countries; for others the controller must prove adequacy) or the data subject has consented in a form suited to the data; data so transferred is not onward transferred to a third country without express consent; applicants give a written undertaking (Form 3); breaches carry daily fines.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.