Personal data can be transferred without authorisation to countries that have signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. Transfers to other countries can only take place if the recipient country provides for the same level of protection as required in the Convention. Such transfers also require authorisation from the Serbian Commissioner for Information of Public Importance and Personal Data Protection. The requirements and procedures for seeking this authorisation are not listed in the law. 