Data can be transferred to third countries in the event that there is an adequate level of protection in that country. The list of suitable countries is determined by the Personal Data Protection Board based on pre-defined criteria (e.g., assessment of the laws of the countries in question, or existence of reciprocity conditions, or transfer must form part of obligations under international law). The explicit consent of the data subject is also required before the transfer can take place except under certain limited circumstances.