Article 47 (5) of the Data Protection Act states that The Commission may authorise the processing or transfer of personal data to another country, provided that it is part of a cross border privacy rules system that ensures data controllers and data processors have implemented security measures using a risk-based approach proportional to the probability of the threat and severity of the harm, the confidential nature of the information processed and the number of data subjects affected.