Personal data of a Vietnamese citizen may be transferred abroad only if the transferor (controller, controlling and processing entity, processor or third party) has compiled a transfer impact assessment dossier and followed the procedure: the dossier holds the contact details of transferor and recipient, of the person in charge of the transfer, a description of the processing objectives abroad, the categories of data transferred, a demonstration of compliance with the Decree and the protection measures taken, an impact assessment with likely consequences and mitigations, the data subject's article 11 consent given with awareness of the incident response and complaint mechanism, and a document binding transferor and recipient in the processing; an original on Form 06 must be sent to the Ministry of Public Security (A05) within 60 days of the start of processing, the transferor must notify the Ministry in writing with contact details once the transfer succeeds, complete an incomplete dossier and update it on Form 05 within 10 days of a request when contents change; the Ministry may examine transfers once a year or on a breach or leak, and may order transfers stopped where the data are used against Vietnam's interests or national security, where the transferor fails to complete or update the dossier, or where a leak or loss of Vietnamese citizens' data occurs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.