Transfer to third parties shall mean an operation aimed at transferring personal data to a certain scope of persons or the public at large or at familiarizing with them, including disclosure of personal data through the mass media, posting in information communication networks or otherwise making personal data available to another person. 

The processor may transfer personal data to third parties or grant access to data without the personal data subject's consent, where it is provided for by law and has an adequate level of protection. 

The processor may transfer special category personal data to third parties or grant access to data without the personal data subject’s consent, where: 

• the data processor is considered as a processor of special category personal data prescribed by law or an interstate agreement, the transfer of such information is directly provided for by law and has an adequate level of protection;
• in exceptional cases provided for by law special category personal data may be transferred for protecting life, health or freedom of the data subject. 

Personal data may be transferred to another country with the data subject's consent or where the transfer of data stems from the purposes of processing personal data and/or is necessary for the implementation of these purposes. 

Personal data may be transferred to another state without the permission of the authorized body, where the given state ensures an adequate level of protection of personal data. An adequate level of protection of personal data shall be considered to be ensured, where:

• personal data are transferred in compliance with international agreements;
• personal data are transferred to any of the countries included in the list officially published by the authorized body.

Personal data may be transferred to the territory of the State not ensuring an adequate level of protection only by the permission of the authorized body where personal data are transferred on the basis of an agreement, and the agreement provides for such safeguards with regard to the protection of personal data which were approved by the authorized body as ensuring adequate protection.

In cases referred to in the previous paragraph the processor of personal data shall be obliged — prior to the transfer of data to another country — to apply to the authorized body to obtain permission. The processor of personal data shall be obliged to specify in the application the country where personal data are transferred, the description of the recipient of personal data (name, legal form), the description (content) of personal data, the purpose of processing and transferring personal data, agreement or the draft thereof. The authorized body shall be obliged to permit or reject the application within 30 days. The authorized body may require from the processor of personal data additional information by observing the time limit for the consideration of the application. In case when the authorized body finds that contractual safeguards are not sufficient, it shall be obliged to specify those necessary changes which will ensure safeguards for the protection of personal data.

Personal data under the disposition of state bodies may be transferred to foreign state bodies only within the scope of interstate agreements, whereas to non-state bodies in accordance with the norms provided above.