Article 47 of the Data Protection Act provides conditions where cross-border transfers of data is allowed such as the comparable level of data protection and security measures using a risk-based approach implemented by data controllers.