c) provide guidance to a data controller on, and make a determination with respect to, the adequacy of protection afforded in relation to any specific transfer of personal data under sub-article 1; and d) require any data controller to notify the Authority of the conditions relied upon under sub-article 1 for a transfer of personal data. 5. Whether or not the Authority makes any rule or guideline or designation under sub-article 4a) or b) shall not affect whether or not a data controller is in compliance with sub-article 1. Article 31: Cross-border transfers in the absence of adequate protection 1. If none of the conditions in article 30(1)a), b) or c) apply, a data controller may nevertheless transfer personal data to a country outside of the Federal Republic of Somalia or an international organisation if: a) the data subject has given and not withdrawn consent to such transfer after having been informed of the possible risks of such transfers for the data subject due to the absence of adequate protections; b) the processing is necessary for the entering into or performance of a contract with the data subject; c) the transfer is necessary for the entering into or performance of a contract made in the interest of the data subject between the data controller and a third party; or d) the transfer is for the benefit of the data subject and: i. it is not reasonably practicable to obtain the consent of the data subject to that transfer; and ii. if it were reasonably practicable to obtain such consent, the data subject would likely give it. 2. Where a transfer of personal data to a country outside the Federal Republic of Somalia or an international organisation could not be based on a provision in article 30 or 31(1), the transfer may take place only if: a) the transfer is not repetitive; b) the transfer concerns only a limited number of data subjects; c) the transfer is necessary for the purposes of compelling legitimate interests pursued by the data controller which are not overridden by the interests or rights and freedoms of the data subject; and d) the data controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. 3. In the case of a transfer made under sub-article 2, the data controller shall: 24