(7) The rights mentioned in this section shall not affect the rights and freedoms of other data subjects. CHAPTER VI TRANSFER OF PERSONAL DATA OUTSIDE PAKISTAN 30. Restrictions on transferring personal data.- (1) Personal data shall not be transferred to any unauthorised person or system or anything contrary to the provisions of this Act. 31. Condition for Cross border transfer. – (1) Where personal data excluding critical personal data is required to be transferred to an entity/entities or system located beyond the borders of Pakistan, which is not under the direct control of the Government of Pakistan, it shall be ensured that the country where the data is being transferred offers at least adequate personal data protection legal regime which is consistent to the protection provided under this Act and the data which is transferred shall be processed as per the provisions of this Act and, where applicable, the data subject shall give explicit consent. (2) Critical Personal Data shall only be processed in a server(s) or digital infrastructure located within the territory of Pakistan. 32. Framework on conditions for cross-border transfer. – (1) Personal data other than those categorised as critical personal data may be transferred outside the territory of Pakistan after fulfilling necessary explicit consent requirements under this Act. In the absence of an adequate data protection legal regime, the Commission may allow for the transfer of personal data outside Pakistan in the following cases: (a) Binding contract/agreement; (b) Explicit consent of the data subject that does not conflict with the public interest or national security of Pakistan; (c) International cooperation is required under relevant international obligations; and (d) any further conditions specified by the Commission. (2) The Commission shall also devise a mechanism for sharing sensitive personal data with the government of Pakistan provided that the data relates to public order or national security and the same is required within the parameters of applicable law. The data controllers or 29