The transfer of personal information abroad is permitted only when the laws of the destination country ensure a substantially similar privacy protection as POPI or one of the other conditions are met (e.g., the data subject consents to the transfer). Private sector safeguards, such as binding corporate rules, may also be put in place.