The general rule is that data transfers are only possible to countries that ensure an adequate level of protection or if certain other 'pre-authorised' safeguards are in place.The Personal Data Protection Act implements the requirements of EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Article 25 and 26. 