The general rule is that data transfers are only possible to countries that ensure an adequate level of protection or if certain safeguards are in place (for instance, the data subject consented to the transfer or data protection is ensured through a contract between the data sender and data receiver or through binding corporate rules, etc.). The law on the protection of individuals implements the requirements of EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Article 25 and 26. 