Personal Data Protection Act GN. NO. 395B (Contd) concerned, is processed under the supervision of a health professional in accordance with the law governing such health care services. PART V TRANSBORDER DATA FLOW Transfer of personal data to state with adequate personal data protection 31.-(1) The Commission may, subject to the provisions of this Act, prohibit the transfer of personal data to a place outside the country. (2) Personal data shall be transferred to country that has a legal framework that provides for adequate data protection, if(a) the recipient establishes that the personal data is necessary for the performance of a task carried out in the public interest or pursuant to the lawful functions of a data controller; or (b) the recipient establishes the necessity of having the data transferred and there is no reason to assume that the data subject's legitimate interests might be prejudiced by the transfer or the processing in the recipient country. (3) The data controller shall, notwithstanding subsection (2), be required to make a provisional evaluation of the necessity for the transfer of the personal data. (4) The recipient shall ensure that the necessity for the transfer of the personal data can be subsequently verified. (5) The data controller shall ensure that the recipient shall process the personal data for the purposes for which it was transferred. Transfer of personal data to state without adequate personal data 32.-(1) Personal data may be transferred to recipients states other than those referred to under section 31, if an adequate level of protection is ensured in the country of the recipient and the personal data is 20