Cross-border transfer of personal data is only possible with countries that provide a "sufficient" level of protection. The list of countries who satisfy this criteria is determined by a decision of the national Commissioner on the right to information and protection of personal data (in 2016, the list contained 51 countries). 