Except for transfers to processors, the transferring controller must make it a condition that the data are not transferred onward to a third country or international organisation without authorisation of a UK competent authority (or, in an emergency to prevent an immediate and serious threat, without it but with the UK authoriser informed), which may authorise only for a law enforcement purpose after weighing seriousness, original purpose and the destination's standards, and, for EU-origin data, only with the member state's authorisation. For transfers to processors, onward transfer must follow the section 59 contract and meet section 73(1).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.