Transfer of personal data is only possible to countries whose legislation has been declared adequate or when certain private sector safeguards are in place (e.g.consent, or, as of 2016, standard contractual clauses, and, as of 2018, binding corporate rules)