The general rule is that data transfers are only possible to countries that ensure an adequate level of protection or if certain other 'pre-authorised' safeguards are in place. The EU Commission determines which third countries are deemed to provide adequate data protection. In the absence of such adequacy decision, data transfer may be possible based on appropriate safeguards, such as binding corporate rules.The Personal Data Protection Act implements the requirements of EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Article 25 and 26.