As set out under the General Principle, transfers of personal data by a data controller or a data processor to countries or territories outside the British Virgin Islands are only permitted where that country or territory ensures an adequate level of protection of data protection safeguards in relation to the processing of personal data. This transfer restriction endeavors to ensure that the level of protection provided by the DPA is not circumvented by transferring personal data abroad.

The DPA also includes the following exceptions where the General Principle will not apply to a transfer:

• if the data subject has consented to the transfer (where consent must be freely given, specific, informed, and unambiguous and must be capable of being withdrawn at any time)
• where the transfer is necessary for the performance of a contract between the data subject and the data controller, or the taking of steps at the request of the data subject with a view to the data subject entering into a contract with the data controller
• the transfer is necessary for the conclusion of a contract between the data controller and a person other than the data subject, being a contract that is entered into at the request of the data subject, or is in the interests of the data subject, or for the performance of such a contract;
• the transfer is necessary for reasons of substantial public interest
• the transfer is for a lawful purpose directly related to an activity of the data controller, is necessary for, or directly related to, that purpose, and the personal data is adequate but not excessive in relation to that purchase
• the transfer is necessary in order to protect the vital interests of the data subject
• the transfer is necessary for the administration of justice, or
• the transfer is required for the exercise of any functions conferred on a person by law.