Transfers of personal data abroad can only be made to countries and organisations deemed to have an adequate level of protection in place. Such determination is made by the Data Protection Agency, and the list of approved countries and organisations is published in the official gazette. If data is intended for countries or organisations that have not been approved, the Agency must authorise the transfer on a case-by-case basis on grounds of sufficient safeguards implemented by the data sender.  