Cross-border transfer of personal data is subject to the consent of the data subject and to the existence of a contract between the data controller and the data recipient. Transfer of personal data without the consent of the data subject is only be possible under certain circumstances.