The transfer of personal information abroad is permitted when the laws of the destination country are substantially similar to the information protection principles under Data Protection Act of Lesotho, or one of the other conditions are met (e.g., the data subject consents to the transfer or the transfer is necessary for the performance of contract between the data subject and data controller). Private sector safeguards, such as binding corporate rules, may also be put in place.