It is not permitted to transfer personal information about a data subject to a third party who is in a foreign country unless:
- the recipient of the information is subject to a law, binding corporate rules or binding agreement which provide an adequate level of protection;
- the data subject consents to the transfer;
- the transfer is necessary for the performance of a contract between the data subject and the data controller, or for the implementation of pre-contractual measures taken in response to the data subject’s request;
- the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and a third party; or
- the transfer is for the benefit of the data subject, and:
- it is not reasonably practicable to obtain the consent of the data subject to that transfer; and
- if it were reasonably practicable to obtain such consent, the data subject would be likely to give it.
Binding Corporate Rules (BCRS)
Binding corporate rules are recognised by the Protection of Personal Information Act 2013, and refer to personal information processing policies, within a group of undertakings, which are adhered to by a data controller or operator within that group of undertakings when transferring personal information to a data controller or operator within that same group of undertakings in a foreign country.