Article 28 of the Data Protection Act provides that a data controller may not transfer personal information about a data subject to a third party who is in a foreign country unless an adequate level of protection is ensured in the country of the recipient or within the recipient’s international organisation and the data is transferred solely to allow tasks covered by the competence of the controller to be carried out. Article 29 of the Act further states that, in the absence of the adequate level of protection, the transfer can be done for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken in response to the data subject’s request.