Controllers may transfer personal information to a third party abroad only if the recipient country or organisation ensures an adequate level of protection, assessed on all circumstances (data nature, purpose, duration, recipient, laws and security rules), and only for tasks within the controller's competence; the Authority may bar categories of transfers and ministers may give directions. Transfers to countries without adequate protection are allowed with unambiguous consent, for contracts with or in the interest of the data subject, on important public interest or legal claims grounds, to protect vital interests, or from public registers. Unlawful transfer is an offence (s.33(2)); regulation 10(2)(c) requires notice to the Authority of intended transfers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.