A new Data Protection Act was passed in March 2022. There was no legal instrument governing data flows before then. Section 33(5) provides that data may be transferred abroad and to countries other than SADC if the controller satisfies the Commission that it shall ensure adequate safeguards with respect to the protection of privacy and fundamental rights and freedomes of the data subjects including through legal and security measures and contractual clauses in particular. Note that under Section 32 there is a more open data transfer mechanism within SADC Member States. 