Section 75 of the DPA: A transfer of personal data to a third country or an international organisation is based on there being appropriate safeguards where: (a) a legal instrument containing appropriate safeguards for the protection of personal data binds the intended recipient of the data, or (b) the controller, having assessed all the circumstances surrounding transfers of that type of personal data to the third country or international organisation, concludes that appropriate safeguards exist to protect the data.