Personal data is transferred to foreign parties only where the state ensures adequate protection (EEA states, signatories of Council of Europe Convention 108, and since 2024 states whose capital-market regulators signed the IOSCO multilateral memorandum are recognised; the Cabinet of Ministers keeps a list), or with the subject's unambiguous consent, for a transaction for the subject's benefit, vital interests, public interest or legal claims, or where the controller gives guarantees of non-interference with private and family life; data is not used for another purpose than collected; during martial law and six months after, telemedicine transfers may follow the law of the treating country (not to Russian or Belarusian citizens).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.