The transfer of personal data to a foreign country or to an international organisation is subject to prior authorisation being obtained from the Personal Data Protection Authority under conditions that guarantee the exercise of the data subject's rights.

When issuing such authorisation, the Personal Data Protection Authority must first ensure that: 

• that the country of destination of the personal data offers an adequate level of protection;
• the prior entry into force of a legal instrument signed with the country of destination of the personal data transferred, in liaison with the competent authorities and bodies;
• the entity requesting the import of personal data is subject to binding security rules for the protection of such data
• the prior subscription, by the importing and exporting entities concerned, of standard contractual clauses relating to the international transfer of personal data, drawn up and published by the Personal Data Protection Authority.