What Needs to be Done Prior to Shipping

Transfer of data to a third country.

27. (1) Without prejudice to the provisions of article 28, the transfer to a third country of personal data that is undergoing processing or intended processing, may only take place subject to the provisions of this Act and provided that the third country to which the data is transferred ensures an adequate level of protection.

(2) The adequacy of the level of protection of a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations; particular consideration shall be given to the nature of the data, the

purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.

(3) It is for the Commissioner to decide whether a third country ensures an adequate level of protection.

(4) The transfer of personal data to a third country that does not ensure adequate protection is prohibited.

Please see the Office of the Data Protection Commissioner website for further details on the statute