NIST Privacy Framework, Control-PCT.PO-P2

Before transferring personal data outside Barbados, confirm the destination provides an adequate level of protection or rely on an appropriate safeguard such as standard clauses or binding corporate rules.

Submit any binding corporate rules you rely on to the Commissioner for authorisation, and make them specify what section 25 requires, including the data subjects' rights and how to exercise them, the acceptance of liability, the complaint procedures and the compliance-verification mechanisms.

Confirm the destination country is on the authorized agency's adequate-country list before transferring personal data of a person in Belarus outside the country, or rely on one of the seven Article 9 exceptions, such as the subject's informed consent to the risks or performance of a contract with the subject, or obtain the agency's own permit.

This law has no Standard Contractual Clauses or Binding Corporate Rules self-assessment route for a cross-border transfer; an operator outside the adequate-country list and outside the Article 9 exceptions needs the authorized agency's case-by-case permit.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Belgium outside the EEA; a grossly negligent or malicious breach is a criminal offense under Act Article 222, 4.

Before transferring personal data of a person in Belize outside the country, confirm the destination has an adequate level of protection or put an appropriate safeguard in place, such as standard contractual clauses or binding corporate rules.

Obtain the Autorité de Protection des Données Personnelles (APDP)'s finding that the destination country or international organization assures a level of data protection equivalent to Benin's own before any transfer of personal data outside Benin.

Obtain the Autorité's prior authorization before any actual transfer of personal data to a third country or international organization, even where an equivalence finding exists.

Remain responsible for a transfer of personal information to an overseas third party complying with this Act, unless a specific exception (such as a small-scale, occasional transfer unlikely to prejudice an individual's rights) applies.

Rely on a Council of Ministers adequacy decision, or an appropriate safeguard such as standard contractual clauses, binding business rules, or an approved code of conduct or certification, before transferring personal data outside Bosnia and Herzegovina, under Articles 46 to 49.

Absent an adequacy decision or an appropriate safeguard, transfer personal data outside Bosnia and Herzegovina only on a narrow derogation such as the person's informed explicit consent, contractual necessity, or an essential public interest, and never repetitively or systematically, under Article 51.

Before transferring personal data to a third country or an international organisation, including an onward transfer, obtain an adequacy decision from the Commission, put in place appropriate safeguards or approved binding corporate rules, or rely on a listed derogation.

Transfer personal data outside Brazil only to a country or organization with an adequate level of protection, or under contractual clauses, corporate rules, or another article 33 safeguard.

Where you rely on standard contractual clauses, specific contractual clauses, global corporate rules, or a certification seal for a transfer, use only a form the ANPD has verified or approved, and report any change to those safeguards to it.

Brunei's Personal Data Protection Order 2025 has required, since this duty (Part 6) took effect 1 January 2026 under Government Gazette No. S 11/2025, an organisation to meet a comparable-protection standard, set by regulations not yet located, before transferring personal data, including a voiceprint or other biometric identifier, outside Brunei Darussalam, unless the Authority has granted an exemption.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Bulgaria outside the EEA.

Before transferring personal data to a foreign country or an international organization, confirm that it assures a level of protection adequate to the protection Burkina Faso itself assures for privacy, fundamental freedoms and rights.

Before any transfer of personal data outside Burkina Faso, obtain the CIL's authorization, sign a data confidentiality and reversibility clause with the receiving party letting data migrate back fully at the end of the contract, and put in place technical and organizational security measures covering encryption, availability, confidentiality, integrity and resilience.

Confirm that a destination country ensures an adequate level of data protection before transferring personal data there, and expect the CNPD to decide adequacy by the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, and the legal, professional and security rules in force there.

Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the CNPD's permission based on the data subject's unambiguous consent or one of the law's other listed grounds, such as contractual necessity, an important public interest or legal claim, the data subject's vital interests, or a public register open to consultation.

A data controller must not transfer personal data outside Cambodia unless the Ministry of Post and Telecommunications grants permission, the controller assesses that appropriate safeguards are in place, or the transfer rests on one of six listed circumstances such as the data subject's written consent.

Do not transfer personal data outside the Islands unless the receiving country or territory ensures an adequate level of protection for data subjects, or a Schedule 4 exception (consent, contractual necessity, or Ombudsman-approved terms) applies.

Before transferring personal data outside the Central African Republic, confirm the destination offers a similar level of protection, or rely on one of the Act's specific derogations.

Do not let a recipient in a foreign State transfer the data onward to another State without your agreement as the original controller.

Do not transfer personal data to a country outside the CEMAC and CEEAC blocs unless that country ensures a sufficient level of protection for privacy and fundamental rights and freedoms.

Before any transfer of personal data to a country outside the CEMAC and CEEAC blocs, inform ANSICE in advance.

Complete a CAC security assessment, personal-information-protection certification, or CAC standard contract before transferring personal information out of China, unless a specific exemption applies.

Store personal information collected within China domestically if operating as a critical information infrastructure operator or processing above the state-set volume threshold; export only after a security assessment.

Confirm which volume tier applies before exporting personal information from China: under 100,000 individuals' non-sensitive personal information a year (or a listed necessary-business exemption) needs no mechanism, 100,000 to under 1,000,000 needs a standard contract or certification, and 1,000,000 or more, or sensitive personal information export above 10,000 individuals, needs the full CAC security assessment.

Complete a security assessment before any cross-border personal information export if operating as a critical information infrastructure operator, regardless of volume.

Do not transfer personal data to a country the Superintendencia de Industria y Comercio has not found to offer an adequate level of data protection, absent a recognized exception.

Rely on the cross border transfer exceptions only where the data subject has given express and unequivocal authorization for the transfer, the transfer is a medical exchange required for treatment or public health, a banking or securities transfer under its own law, a transfer under a reciprocal international treaty Colombia has joined, a transfer necessary to perform a contract with the data subject, or a transfer legally required to safeguard the public interest or defend a right in a judicial proceeding.

Do not transfer personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms, judged by the protections and security measures in force there and by the nature, origin and destination of the data.

Obtain the Commission's prior authorization before a processing operation that provides for transferring personal data to another state, even where you rely on contractual clauses or internal rules to show a sufficient level of protection.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Croatia outside the EEA.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Cyprus outside the European Economic Area.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in the Czech Republic outside the EEA.

Before transferring personal data to a third country, confirm that country affords a level of protection of privacy, freedoms and fundamental rights equivalent to or higher than Côte d'Ivoire's.

Obtain ARTCI's prior authorization before implementing any processing that transfers personal data to a third country, and its permission again before the actual transfer takes place.

Store personal data in the Democratic Republic of the Congo, and do not transfer it to a third country, digital embassy, or international organization unless the Data Protection Authority finds an adequate level of protection.

Obtain the Data Protection Authority's prior authorization before any actual transfer of personal data to a third country or international organization, even after an adequacy finding.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Denmark outside the European Economic Area.

Do not transfer personal data to a country or international organization outside Djibouti unless it offers an adequate level of protection or another authorized safeguard applies.

Apply the same adequacy or safeguard requirement to an onward transfer from the destination country or organisation to a further one, not only to the first transfer out.

Before transferring personal data outside the Dominican Republic, obtain the data subject's free authorization or rely on one of the law's nine specific statutory grounds for the transfer.

Confirm a cross border transfer made without the data subject's consent fits one of the law's enumerated grounds, such as medical treatment or epidemiological research, a banking or securities transaction, an international treaty or free trade agreement commitment, intelligence cooperation against organized crime or terrorism, contractual necessity, a legal requirement to safeguard the public interest or a judicial proceeding, international judicial assistance, or a request from an international organization acting on a public register.

Before transferring personal data outside Ecuador, obtain an Authority adequacy resolution, put appropriate safeguards in place, or obtain the Authority's case-by-case authorization.

Where you rely on binding corporate rules, make them meet what article 58 requires before transferring on them.

Obtain a Center license or permit before transferring, storing, or sharing personal data outside Egypt, unless the destination country's protection level meets or exceeds Egypt's own, or the data subject has given explicit consent.

Where you rely on the Data Subject's explicit consent instead of the minimum protection level, use only one of the seven cases article 15 lists.

Before transferring personal data to another country or international organization, confirm the receiving country meets at minimum this Law's data protection principles or applicable international standards, and take appropriate measures to secure the data at the point of transfer if the receiving country's protection is not adequate.

Obtain the data subject's prior consent before an international transfer of their personal data, unless a reciprocal treaty exception applies or the transfer falls under a Central American Economic Integration treaty.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Estonia outside the European Economic Area.

Before transferring personal information to a recipient in a SADC Member State, confirm the State has transposed the SADC data protection requirements and that the transfer is necessary for a public interest task or your lawful functions, or that no reason exists to think it would prejudice the data subject's legitimate interests.

Before transferring personal information to a recipient outside a SADC Member State, confirm an adequate level of protection is ensured in the recipient's country, considering the nature of the data, the purpose and duration of the processing, and the recipient country's laws and security measures.

Before transferring personal data to a third-party jurisdiction, confirm the jurisdiction ensures an appropriate level of protection, obtain the data subject's informed consent, or meet another condition the Proclamation lists.

Get the Authority's prior approval before any cross-border transfer of sensitive personal data.

Rely on a Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data covered by the Regulation outside the EEA.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Finland outside the European Economic Area.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in France outside the EEA.

Obtain the APDPVP's prior authorization before transferring personal data to another State; consult the list of States the Authority has found to offer a sufficient level of protection.

Absent that authorization, transfer only where the data subject has expressly consented to the specific transfer and it is necessary to safeguard their life or the public interest, to establish, exercise or defend a legal claim, to consult a public register, or to perform or negotiate a contract with or for the data subject's benefit, or where the APDPVP or a decree has found the processing otherwise offers a sufficient level of protection, such as through contractual clauses or binding internal rules.

Before transferring personal data out of The Gambia, confirm that the receiving country or international organisation has a law providing an appropriate level of protection, or put appropriate safeguards in place through an ad hoc or standardised instrument the Information Commission has adopted.

An app transferring the personal data of a person in Georgia to a recipient outside Georgia must rely on the destination being on the State Audit Office's adequacy list, a State Audit Office-permitted contractual safeguard, the data subject's informed written consent, or another Art. 37 statutory basis.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Germany outside the European Economic Area.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Greece outside the European Economic Area.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Hungary outside the EEA.

Confirm that a European Commission adequacy decision has its own EEA Joint Committee decision and ministerial confirmation, published in the Law Gazette, before relying on it for a transfer of personal data of a person in Iceland outside the EEA, under Act No. 90/2018 Article 16.

Rely on Standard Contractual Clauses, Binding Corporate Rules, or a narrow derogation where no confirmed adequacy decision covers the destination country.

An app transferring the personal data of an individual in Indonesia, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Indonesia must ensure the recipient's country of domicile provides a level of personal data protection equal to or higher than this Law's standard.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Ireland outside the European Economic Area.

An app transferring the personal data of a person in Israel to a recipient outside Israel must rely on the destination providing protection no less than Israeli law's, or on one of the regulation's eight alternative grounds, most commonly consent, a common-control guarantee, an inter-party agreement, or an authority-gazetted adequate jurisdiction, and must obtain a written guarantee from the recipient in every case.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Italy outside the EEA.

Do not transfer personal data to a State or territory outside of Jamaica unless that State or territory ensures an adequate level of protection for the rights and freedoms of data subjects.

Rely on a case in section 31(4), such as the data subject's consent or the necessity of the transfer for a contract with the data subject, only where that case actually applies, or transfer on terms of a kind the Information Commissioner has approved.

An app transferring the personal data of a person in Japan to a recipient in a foreign country must obtain the data subject's prior consent after disclosing the destination country's protection system and the recipient's own measures, unless the destination is a PPC-recognized equivalent jurisdiction or the recipient maintains APPI-equivalent measures.

Give the Data Commissioner proof of appropriate safeguards, or otherwise satisfy a condition under section 48, before transferring personal data outside Kenya.

Before processing personal data outside Kiribati or transferring it to a person outside Kiribati, take reasonable steps to verify that the recipient jurisdiction affords adequate protection, meaning restrictions and obligations substantially similar to Parts III and V, rights substantially similar to Part IV, and that those restrictions, obligations and rights are substantially enforceable.

Where adequate protection cannot be verified, transfer or process personal data outside Kiribati only on another listed basis, such as the data subject's informed consent to the transfer, contractual necessity, a medical emergency, a transfer for the data subject's benefit where consent is impracticable but would likely be given, or a transfer under an international agreement such as a mutual legal assistance treaty.

Before transferring personal data to another state or an international organisation, confirm the destination is on the Agency's adequacy list, or ensure the transfer meets one of Article 49's other bases, such as the data subject's informed consent or the controller's own adequate safeguards.

Do not disclose or transfer personal data in response to a foreign court judgment or administrative decision unless an international agreement between that state and Kosovo authorises recognition or enforcement of the request.

An app transferring the personal data of a Kyrgyzstani data subject, including a voiceprint or other biometric identifier, to a state the sectoral regulator has listed as adequate may do so freely. Transfer to a non-listed state requires the subject's consent, a qualifying treaty, statutory necessity, or contract necessity. Kyrgyzstan imposes no domestic-storage or localization requirement on the data itself.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Latvia outside the European Economic Area.

Declare in the permit you file with the Ministry of Economy and Trade any transfer of personal data to another State, in any form, that the processing involves.

Keep that declaration accurate for the life of the processing, because the Ministry publishes the personal data intended for transfer to a foreign State against your entry on its public list.

Before transferring personal information about a data subject to a third party in a foreign country, confirm the recipient is subject to a law, code of conduct, or contract that effectively upholds processing principles substantially similar to this Act's, including onward-transfer protections, or rely on another listed condition.

Obtain the data subject's consent to the transfer where you do not rely on the recipient's equivalent legal protection.

Before transferring personal data outside Libya, give due consideration to the nature of the data, its source, the purpose and duration of processing, and the destination country's international commitments, applicable law, rules, and security measures.

Before moving personal data of a person in Liechtenstein to a country outside the European Economic Area, meet a condition of GDPR Chapter V, such as an adequacy decision under Article 45 or appropriate safeguards under Article 46.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Lithuania outside the European Economic Area.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Luxembourg outside the European Economic Area.

Before transferring personal data to a foreign State, confirm that State's law assures a similar level of protection, weighing the data's nature, the processing's purpose and duration, the countries of origin and destination, and the destination's laws, professional rules, and security measures.

Where the destination does not assure a similar level of protection, obtain CMIL authorization by offering sufficient guarantees such as appropriate contractual clauses or binding internal rules, or rely on one of the law's listed exceptional grounds, such as the data subject's informed consent to the transfer.

A Controller or Processor must not transfer personal data outside the Maldives without appropriate safeguards, and only where enforceable data subject rights and effective legal remedies are available in the destination.

An agreement with a cross-border recipient must carry a data protection process the Data Protection Authority endorses, or the transfer must rest on binding corporate rules the Authority has approved.

Before transferring personal data to a foreign country, confirm that the Autorité de Protection des Données à Caractère Personnel has found the destination State's own legislation or international commitments provide a sufficient level of protection that is actually applied, or obtain an Autorité decision that the transfer and the recipient's processing, including through contractual clauses or internal rules, guarantee a sufficient level of protection for privacy and fundamental rights and freedoms.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Malta outside the European Economic Area.

Do not transfer personal data to a country that does not ensure an adequate level of protection unless it appears on the Authority's published list of adequate countries, or a narrow consent-based or public-interest derogation applies.

Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the Personal Data Protection Authority's authorisation on a motivated request, backed by sufficient guarantees such as appropriate contractual clauses.

Give the Commissioner proof of appropriate safeguards, obtain the data subject's explicit informed consent, or otherwise satisfy a condition under section 36(1), before transferring personal data outside Mauritius.

Do not transfer personal data without the data subject's consent unless a listed Article 36 ground applies, such as a legal or treaty basis, a transfer within a corporate group under common control, or a ground necessary to a contract or legal relationship with the data subject.

Rely on the National Centre for Personal Data Protection's adequacy list or an approved standard transfer agreement before transferring personal data of a person in Moldova outside the country.

Apply the same conditions to an onward transfer from the destination country or organisation to another one, not only to the first transfer out.

Before transferring personal data outside Monaco, confirm that the destination country, territory, or international organisation has an adequate level of protection, and treat every European Union member state as meeting that standard.

Absent an adequacy finding, rely on an appropriate safeguard, such as an executory international commitment, standard clauses the Authority has approved, binding corporate rules the Authority has approved, an approved certification mechanism, or an approved code of conduct.

Obtain the prior consent of the Agency for Personal Data Protection and Free Access to Information before transferring personal data of a person in Montenegro to another country or to an international organisation, under Article 41, unless one of the Article 42 exceptions applies, including transfer to an EU or EEA Member State or a country on the EU adequacy list, the data subject's informed consent, or performance of a contract.

Assess the adequacy of protection in the destination country against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law and security measures in force there, under Article 41, paragraph 2.

Do not transfer personal data to a foreign country unless that country appears on the CNDP's list of states that ensure a sufficient level of protection.

Where the destination country is not on that list, transfer personal data only with the data subject's express consent, under one of the Article 44 necessity grounds, under a bilateral or multilateral agreement Morocco is party to, or with the CNDP's own express and reasoned authorization.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in the Netherlands outside the EEA.

Before disclosing personal information to an overseas recipient, confirm one of information privacy principle 12's safeguards applies: the individual's informed authorisation, the recipient being subject to this Act or a comparably safeguarded overseas law, the recipient's participation in a prescribed binding scheme, the recipient being subject to a prescribed country's laws, or another reasonable basis to believe the recipient will protect the information comparably.

Before transferring personal data outside Nicaragua, confirm the receiving country or organization provides an adequate level of security and protection, or that the transfer fits one of the law's listed exceptions, such as international judicial cooperation, a health data exchange for epidemiological investigation, a banking or securities transfer, a ratified treaty commitment, or intelligence cooperation against organized crime or drug trafficking.

Before making the transfer, verify that both you and the recipient meet the applicable security and confidentiality measures, inform the data subject of the request and its purpose for their consent, prevent the data from reaching a third party, and notify the Direccion de Proteccion de Datos Personales of the transfer you made.

Before transferring personal data to another State, confirm that State ensures a sufficient level of protection for privacy and fundamental rights and freedoms, weighing its data-protection laws and regulations, the existence of a protection authority, applicable international conventions, or HAPDP-approved safeguards.

Before any transfer, implement technical and organisational security measures, including encryption and measures for availability, confidentiality, integrity and system resilience, and obtain the HAPDP's authorisation for the transfer.

Before transferring personal data outside Nigeria, rely on an adequacy decision by the Commission, a Commission-approved cross-border data transfer instrument, or another lawful basis such as consent or a compelling legal or fiduciary duty.

Obtain the data subject's consent before transferring their personal data to a country for which the Commission has made no adequacy decision.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Norway outside the European Economic Area.

Disclose the information outside Ontario only if the individual consents, the Act permits the disclosure, the recipient performs functions comparable to those of a person the Act lets you disclose to in Ontario in the listed cases, the disclosure is reasonably necessary to provide health care to the individual and the individual has not expressly instructed you not to make it, or the disclosure is reasonably necessary to administer payments for health care or for contractual or legal requirements connected with it.

Before storing or transferring personal data domiciled in Panama across a border, confirm you meet this Law's data protection standards, or standards equal to or higher than them, unless the data subject consented, a contract requires it, it is a banking or securities transfer, or a ratified international treaty compels it.

Before an international transfer of personal data, confirm at least one lawful ground applies, among them the data subject's consent, an equivalent or superior protection level in the receiving country, a ratified treaty, medical necessity, transfer within the same corporate group, a contract, a public interest or legal defense need, judicial cooperation, a banking or securities transaction, international intelligence cooperation, a binding self-regulation mechanism, or contractual clauses meeting this Law's protections.

Before transferring personal data outside Paraguay, confirm the destination offers an adequate level of protection or put in place safeguards such as standard contractual clauses, binding corporate rules or a code of conduct.

Apply the same rule to an onward transfer from the destination, not only to the first transfer out.

Before a cross-border transfer of personal data, confirm the destination country maintains an adequate level of protection under the Law, or, where it does not, guarantee as the sender that the processing will comply with the Law.

Assess a cross-border transfer against a level of protection at least equivalent to this Law's own principles and to security and confidentiality measures appropriate to the data's category.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Poland outside the EEA.

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Portugal outside the European Economic Area.

Do not transfer personal data to a country outside the Republic of the Congo unless it offers a sufficient level of protection for the privacy and fundamental rights and freedoms of the persons the data concerns, and inform the national commission of the transfer in advance.

Rely on the article 24 derogation only for a one-off, non-massive transfer, and only where the data subject has expressly consented, or the transfer is necessary to protect that person's life, safeguard the public interest, allow the establishment, exercise or defence of a legal claim, or perform a contract between you and the data subject.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Romania outside the EEA.

Before transferring personal data of a person in Russia to a country not on Roskomnadzor's adequacy list, obtain the subject's written consent naming the recipient country or establish another Article 12 basis.

Do not share or transfer personal data to a third party outside Rwanda unless you have the supervisory authority's authorisation with proof of appropriate safeguards, the data subject's consent, or another listed ground such as contract necessity, public interest, a legal claim, or a ratified international instrument.

Store personal data in Rwanda, and store it outside Rwanda only where you hold a valid registration certificate from the supervisory authority authorising storage abroad.

Once section 45 is in force, transfer personal data outside Saint Lucia only where the receiving country or territory has comparable safeguards and the Commissioner has authorized the transfer, or a listed exception applies, such as the data subject's consent, contractual necessity, national or public security, or Commissioner-approved terms.

Rely on an EU adequacy decision, a bilateral treaty, an appropriate safeguard such as binding corporate rules or standard clauses, or a narrow derogation before transferring personal data of a person in San Marino outside the country, under Articles 45 to 50.

Apply the same conditions to an onward transfer from the destination country or organisation to another one, not only to the first transfer out.

Before transferring personal data outside Sao Tome and Principe, confirm the destination legal order offers an adequate level of protection or rely on a stated derogation, and notify NAPPD of a transfer that relies on one.

Assess the adequacy of the destination legal order's protection in light of the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law, professional rules and security measures in force there, since NAPPD alone decides whether that order meets the standard.

An app transferring the personal data of an individual in Saudi Arabia to a recipient outside the Kingdom must confirm the transfer does not prejudice national security or Kingdom interests, that the destination affords a level of protection at least equivalent to the Law, and that the transfer is limited to the minimum data needed, following the Transfer Regulation's Appropriate Safeguards or Operational Processes conditions where an adequacy finding is not in place.

Transfer personal data to a third country only if it ensures a sufficient level of protection for privacy and fundamental rights, unless a narrow consent-based or necessity derogation applies, and tell the CDP before every transfer to a third country.

Where the destination country does not offer that level of protection and no derogation applies, get the CDP's authorization for the transfer on a motivated request backed by guarantees sufficient to protect the person's privacy and rights.

Transfer personal data outside Serbia freely only to a country, part of a country, sector, or international organization the Commissioner has found to ensure an adequate level of protection, a status presumed for parties to the Council of Europe's Convention 108 on automatic processing of personal data.

Absent an adequacy finding, transfer only where you have put in place appropriate safeguards, such as standard contractual clauses issued by the Commissioner, a legally binding instrument between authorities, or Commissioner-approved binding corporate rules, and only where the person retains enforceable rights and effective legal remedies.

Check whether the Information Commission has prohibited your transfer as necessary in the public interest.

An app transferring the personal data of an individual in Singapore, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Singapore must ensure the recipient provides a standard of protection comparable to the PDPA, through a PDPC-prescribed mechanism, unless the PDPC has granted an exemption.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Slovakia outside the EEA.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Slovenia outside the EEA.

Before transferring personal data outside Somalia or to an international organisation, confirm the recipient country, organisation or mechanism affords an adequate level of protection, or rely on a ground the Act lists.

Before transferring personal information outside South Africa, confirm the recipient country, its binding rules, or an agreement provides an adequate level of protection substantially similar to the Act's conditions, or that another listed transfer ground, such as the data subject's consent, applies.

Obtain the Information Regulator's prior authorisation before transferring special personal information, or a child's personal information, to a country that does not provide an adequate level of protection.

An app transferring the personal data of a Korean data subject to a recipient outside South Korea must obtain the data subject's separate consent, or rely on a qualifying treaty, PIPC certification, or PIPC adequacy recognition instead.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Spain outside the EEA, and check whether LOPDGDD Articles 41-43 require AEPD authorization or prior notice for the specific transfer.

An app transferring the personal data of a person in Sri Lanka abroad, including a voiceprint or other biometric identifier, must ensure it complies with Parts I and II and sections 20 to 25, and must adopt the safeguard instruments the Authority specifies or rely on one of section 26(3)'s derogations, such as the data subject's explicit consent after being told of the risks. A public authority may not send abroad the categories of personal data the Minister prescribes.

Do not transfer personal data to a recipient in a third country unless the recipient is subject to a law, binding corporate rules, or a binding agreement providing a level of protection substantially comparable to this law's processing principles and its own transfer rules, unless an article 6 lawful basis applies or the Commissioner for Personal Data Protection has authorised that specific transfer.

Transfer special categories of personal data or criminal conviction or offence data to a third country only where the recipient is bound by an adequate protection instrument or the Commissioner has authorised the specific transfer, not merely on an article 6 lawful basis.

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Sweden outside the EEA.

Rely on the Federal Council's adequacy list, standard contractual clauses with the Swiss-law addendum, binding corporate rules, or a narrow Article 17 derogation before moving personal data of a person in Switzerland outside an adequate jurisdiction.

Obtain the Authority's license and verify that the destination Arab or foreign state offers an acceptable level of protection before transferring, storing abroad, or sharing personal data with a party there.

Where the destination state lacks a verified protection level, transfer personal data only with the data subject's or their representative's explicit consent and only for one of the purposes article 15(b) lists, such as preserving the data subject's life, defending a legal right, or performing a contract for their benefit.

An app storing or processing the personal data of individuals in Tajikistan, including a voiceprint or other biometric identifier, must by default keep the database exclusively inside Tajikistan, unless it has an arrangement agreed with the authorized state body for personal data protection. Transferring that data abroad separately requires the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.

Before transferring personal data outside Tanzania, confirm the recipient country provides an adequate level of data protection or that another condition under sections 31-32 is satisfied.

An app transferring the personal data of an individual in Thailand to a recipient in another country must ensure the destination has an adequate data protection standard, following the Committee's prescribed rules, unless a statutory exception such as informed consent to an inadequate destination applies.

Before transferring personal data to a third country, confirm that country ensures a sufficient level of protection for privacy and fundamental rights and freedoms, and inform the Instance beforehand for its reasoned opinion.

Where the destination country does not ensure a sufficient level of protection, transfer personal data there only as a one off, non massive transfer with the data subject's express consent, or where the transfer meets one of the law's listed grounds, such as safeguarding the person's life or a contractual necessity.

Do not transfer personal information outside Tonga unless the Privacy Commission has consented in writing, or the recipient is bound by a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism affording an adequate level of protection.

Section 6(l)'s general principle already binds everyone who handles personal information: before disclosing personal information outside Trinidad and Tobago, make sure the disclosure is regulated and that comparable safeguards to those under this Act exist in the receiving jurisdiction.

Once Part III is in force, before a public body discloses personal information to a party in another jurisdiction, tell the individual the purpose of the disclosure and the identity of the requester and the receiving jurisdiction's data protection body, and obtain the individual's consent.

Never transfer or communicate personal data to a foreign country in a way capable of harming public security or Tunisia's vital interests.

Before transferring personal data abroad, confirm the destination country assures an adequate level of protection, assessed against the data's nature, the processing's purpose and duration, and the safeguards in place.

An app transferring the personal data of a person in Turkey to a recipient outside Turkey must rely on a Board adequacy decision for the destination, or, absent one, on Board-approved binding corporate rules, a Board-published standard contract notified to the Authority within 5 business days of signature, a Board-approved written commitment, or an applicable international convention.

Before processing or storing personal data outside Uganda, confirm that the destination country's personal data protection measures are at least equivalent to this Act's, or obtain the data subject's consent to the transfer.

An app transferring the personal data of an individual in the onshore UAE to a recipient outside the UAE must rely on a Bureau adequacy determination for the destination, or on a PDPL-equivalent contractual safeguard, or on the Data Subject's explicit consent where the transfer does not contradict UAE public or security interest.

Before moving personal data of a person in the United Kingdom outside the UK, either rely on a UK adequacy regulation, put appropriate safeguards in place such as the ICO's International Data Transfer Agreement or Addendum, or rely on a narrow Article 49 derogation, under UK GDPR Article 44A.

Do not engage in a prohibited bulk data-brokerage transaction involving bulk U.S. sensitive personal data, including biometric identifiers such as facial images or voice prints, or government-related data, with a country of concern or covered person.

Transfer personal data outside Uruguay only to a country or organization that provides an adequate level of protection under international or regional legal standards, unless one of the law's listed exceptions applies (judicial cooperation, medical necessity, banking or stock-exchange transactions, an applicable treaty, or law-enforcement intelligence cooperation).

Absent an adequate-protection finding, transfer personal data internationally only with the data subject's unambiguous consent, under a contractual-necessity exception, or after the Unidad Reguladora y de Control de Datos Personales authorizes the transfer based on the contractual safeguards you offer.

Do not transfer personal data generated or collected in Vanuatu outside the country without the Minister's prior authorisation, unless the recipient country or organisation is on the Minister's list of jurisdictions providing an appropriate level of protection, or the data subject's informed consent or another situation in section 17 applies.

Store and process personal data on a server or data centre located in Zambia unless the Minister has prescribed an exception, and do not store sensitive personal data outside Zambia without the data subject's explicit consent.

Where you transfer personal data abroad under a standard contract or intra-group scheme the Commissioner approved, certify and periodically report to the Commissioner that the transfer is made under it, and carry the liability for harm caused by the transferee's non-compliance.

Before transferring personal data outside Zimbabwe, confirm an adequate level of protection exists in the recipient's country or that the transfer is solely to carry out tasks within your competence as controller.

Assess adequacy on all the circumstances before the transfer, weighing the nature of the data, the purpose and duration of the processing, who the recipient is, the data protection laws in force there, and the professional rules and security measures complied with.

Only process truthful, complete, exact, updated, verifiable and understandable personal data in an artificial intelligence system, and do not process partial, incomplete, fragmented or misleading personal data.

Do not transfer personal data to a third party or abroad without the data subject's express, valid authorization.

Transfer personal data nationally or internationally only on one of the law's enumerated grounds; a general business justification is not enough.

Keep personal data reliable, adequate, relevant, accurate and not excessive, and correct or erase it once it becomes inaccurate or incomplete.

Obtain the Authority's prior authorization where you cannot provide appropriate safeguards for a transfer to a third-party jurisdiction, and consult the Authority before processing where an impact assessment indicates the operations are likely to present a high risk.

Keep personal data accurate and, where necessary, up to date, and take every reasonable step to ensure that inaccurate personal data, having regard to the purposes for which it is processed, are erased or rectified without delay (Article 5(1), point (d)).

Do not disclose personal data for a new purpose or to a new class of recipient without the data subject's consent, unless the disclosure prevents or detects crime, is authorised by an enactment or court order, or the Minister deems it justified as being in the public interest.

Do not retain personal data longer than necessary for the purpose it was processed for, and take reasonable steps to keep it accurate, complete and up to date.

An app that collects, uses, or discloses the personal data of an individual in Jordan must obtain consent or rely on one of the Law's enumerated alternative bases, must confine retention to the processing purpose unless legislation specifies otherwise, and must appoint a data-protection lead if it processes Sensitive Personal Data or transfers personal data to a database outside Jordan.

Retain personal data only for the period stated in the declaration of processing or in the decision authorizing it.

As a network service provider or data host, keep the traffic data of everyone using your service, the data that identifies them and the other technical data of their communications for three years from the service delivery date, keep it under professional secrecy, and produce it to the judicial police or the court when the competent judicial authority so decides.

Keep customers' information accurate, complete, and up to date for the purposes it is used for.

Keep personal data accurate and up to date, and take reasonable steps to correct or delete inaccurate personal data without delay.

Retain personal data in identifiable form only as long as necessary to fulfill the purpose for which it was collected.

Do not keep personal data longer than its purpose requires, unless you keep it only for historical, statistical, or scientific treatment, and keep it usable, converting it for durable storage where needed.

Keep any personal data you collect, process, or disclose electronically accurate, complete, and up to date.

Do not access another party's personal data in a computerised archive, file, record, or database, and do not transfer personal data between information systems belonging to distinct services or institutions, without a legal instrument or judicial decision authorising it.

Retain a subscriber's information only for billing purposes, and for no longer than 7 years.

Do not retain personal data for longer than five years, or the term your contract with the data subject sets, once the data are no longer adequate, proportional, or necessary for their purpose.

Keep personal data adequate, relevant and accurate, update it where necessary, and correct or erase it once you find it inaccurate or incomplete.

Before disclosing personal data to a requester, identify the requester and the purpose, notify the data subject, and record how long the requester will hold the data and how it will be destroyed, unless the data subject has consented.

Do not disclose personal data identifying a person once seven years have passed since your legal duty to retain it ended, unless that data subject asks you to.

Do not disclose personal data for a new purpose without the data subject's consent, except where crime prevention or detection, legal authorisation, a reasonable belief in a right or in the data subject's consent, or the public interest applies.

Take reasonable steps to keep personal data accurate, complete, not misleading and up to date.

Do not keep personal data longer than its purpose requires, unless you keep it only for historical, statistical, or scientific treatment.

Comply with any order or direction the Telecommunications Commission issues under section 72(3) requiring you to retain, or prohibiting you from retaining beyond a specified period, information relating to a consumer, including billing information.

Process personal information only for a lawful purpose related to your function or activity, take all reasonable steps to keep it accurate, complete, not misleading and up to date for that purpose, and hold no more than is adequate, relevant and limited to it.

Keep personal information accurate, complete and up to date as necessary for the purpose of collection, and protect it with safeguards appropriate to its sensitivity.

Keep the personal data you collect, process, use or hold complete, accurate, up to date and not misleading.

Keep a negative record of a natural person's unpaid commercial obligation registered for no more than five years from its entry, renewable once for another five years if the debt remains unpaid, and update the record within days of being notified the debt was settled.

Keep personal data accurate, adequate and proportionate to the purpose, and for no longer than that purpose requires.

Limit the exchange of health data between health professionals to what coordination or continuity of care strictly requires, and anonymize health data before sharing it or publishing research drawn from it.

Do not treat an insurer or an employer as an authorized recipient of health data unless a law or regulation specifically allows it.

As a consumer reporting agency, furnish information from your files only as section 8 allows: on a court order, on the consumer's written instructions, under an order or direction under the Act, or in a consumer report to a person you have reason to believe intends to use it for credit, a tenancy, employment, insurance underwriting, eligibility under a statute or regulation, a direct business need in a business or credit transaction, or updating a report.

As a consumer reporting agency, adopt all procedures reasonable for ensuring accuracy and fairness in your consumer reports, report only information extracted from files stored or collected in a repository located in Canada, and leave out the items section 9 forbids, including race, creed, colour, sex, ancestry, ethnic origin and political affiliation and most adverse items more than seven years old.

Take reasonable steps to ensure that personal health information you use is as accurate, complete and up-to-date as is necessary for the purposes of the use, and that it is not collected without authority.

Do not disclose a health number except as required by law or as the regulations allow.

Provide credit-reference services only as a credit-information company (a Buró de Información Crediticia) authorized by the Banco Central del Paraguay, supply them only to the identified users article 14 lists, keep credit data lawful, accurate, complete and up to date, retain it for no more than five years from the recorded event unless a special rule sets another period or the parties agree a shorter one, and protect it with security measures and a duty of secrecy.

Do not store, sell, share, or retain a known minor's personal information beyond what is reasonably necessary to provide the service the minor is actively using.

Do not store, sell, or share a known minor's precise geolocation beyond what is reasonably necessary, and only for as long as necessary.

If you rely on legitimate interests to process a Romanian national identification number, put in place appropriate technical and organizational measures, appoint a Data Protection Officer, set specific retention terms with deletion or review deadlines, and train staff periodically.

Comply with the retention periods this Law sets for sensitive personal data.

Get the INPDP's authorization before a physician shares health data with a research body, and never keep or use health data beyond the time its purpose requires.

If you assemble or evaluate consumer information to furnish consumer reports to third parties, furnish a consumer report only under the circumstances section 1681b(a) lists, and follow reasonable procedures to assure maximum possible accuracy of the information in it.

If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.

If you provide an electronic communication service to the public, do not knowingly divulge the contents of a communication in electronic storage by that service to any person or entity unless an exception in section 2702(b) applies.

If you provide a remote computing service to the public, do not knowingly divulge the contents of a communication you maintain for a subscriber or customer solely to store or process it unless an exception in section 2702(b) applies.