Transfers of personal data outside of EU/UK is subject to the supervision of the supervisory authorities in EU/UK and confirmation in respect of whether the foreign country has an adequate level of protection for the data which is to be transferred (Adequacy Decision)

Countries deemed to have adequate data protection laws and for which an Adequacy Decision has been made are included in the personal data inventory

In the absence of a decision, the organisation may transfer personal data to a third country or an international organisation only if there are appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available

In the absence of an adequacy decision and appropriate safeguards, a transfer of personal data to a foreign or international organisation shall only take place on one of the following conditions:

• the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;
• the transfer is necessary for the performance of a contract between the data subject and <<organisation name>> or the implementation of pre-contractual measures taken at the data subject’s request;
• the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;
• the transfer is necessary for important reasons of public interest;
• the transfer is necessary for the establishment, exercise or defence of legal claims; and/or
• the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent.