Data controllers may transfer personal data out of the QFC if the personal data is being transferred to a Recipient in a jurisdiction that the  DPO has decided has laws and regulations that ensure an adequate level of protection for that personal data. The DPO has produced a list of jurisdictions which it deems to have such adequate levels of protection and may also take the following factors into consideration when assessing the adequacy of the level of protection ensured by laws and regulations to which the Recipient is subject to:

• The rule of law, the general respect for individual's rights and the ability of individuals to enforce their rights by administrative or judicial means;
• The access of public authorities to personal data;
• The existence of effective data protection regulations including on onward transfer of personal data to another jurisdiction;
• The existence and functioning of one or more independent supervisory authorities with adequate enforcement powers;
• International commitments and conventions binding on the jurisdiction and its membership of any multilateral or regional organizations;
• Decisions taken by other data protection authorities where their decisions take into consideration the same factors as those the DPO does.

In the absence of an adequate level of protection, data controllers may transfer personal data out of the QFC if any of the following are true:

• The data controller or data processor have appropriate adequate safeguards including enforceable rights and remedies for the data subjects which may be provided by a legally binding and enforceable arrangement between public authorities or a legally binding and enforceable agreement between parties which contain data protection clauses adopted by the DPO;
• The data subject has been informed of the risks of such transfer and has given his / her explicit consent to the proposed transfer;
• Transfer is necessary for the performance of a contract between the data subject and the data controller, or the implementation of pre-contractual measures taken in response to the data subject’s request;
• Transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and a third party;
• Transfer is legally required for the purposes of the data controller's or data processor's compliance with a legal obligation;
• Transfer is necessary in order to protect the vital interests of the data subject;
• Transfer is necessary to perform a task carried out in the public interest or by any of the following authorities in the performs of their functions, the QFC Authority, the QFC Regulatory Authority, the QFC Civil and Commercial Court, the QFC Regulatory Tribunal or a QFC Institution;
• Transfer is necessary for the establishment, exercise or defense of a legal claim.

If none of the above are applicable, a data controller may transfer personal data out of the QFC only if:

• DPO has granted a permit for the transfer or the set of transfers and the data controller applies adequate safeguards with respect to the protection of this personal;
• The transfer is based on binding corporate rules that fulfil the requirements of the DPR and approved by the DPO or another internationally acceptable transfer mechanism approved by the DPO; or
• The transfer:
  • Is not repeating or not part of a repetitive course of transfers;
  • Concerns only a limited number of data subjects;
  • Does not contain sensitive personal data;
  • Is for the purposes of the legitimate interests of the data controller or third party to which the data is disclosed unless sch legitimate interests are overridden by those of the data subject; and
  • The data controller has completed a documented assessment of the circumstances surrounding the data transfer and has provided adequate safeguards with regard to the protection of the personal data.