No. 3 Data Protection or a recipient of personal data outside Malawi provides adequate level of protection of personal data. (2) the authority shall, when carrying out an assessment for purposes of subsection (1), take into account— (a) the availability of enforceable data subject rights and the availability of mechanisms for data subjects to enforce their rights through administrative or judicial processes; (b) respect for the rule of law and human rights and freedoms by the country; (c) the existence of a legally binding instrument between the authority and the relevant public authority in the country, addressing elements of adequacy of data protection; (d) the prevailing policy on access to personal data by a public authority in the country; (e) the existence of an effective data protection law in the country; (f) the existence of a functionally independent and competent data protection or similar supervisory authority with adequate enforcement powers; and (g) international commitment and convention binding on the country, including its membership in a relevant multilateral or regional organization. (3) the authority may decide whether an international organization or a recipient of personal data outside Malawi provides an adequate level of protection of personal data based on comparable adequacy decision made by a competent data protection authority in another country. (4) where an international organization or a recipient of personal data outside Malawi does not provide an adequate level of protection of personal data in accordance with this section, a data controller or data processor shall not transfer personal data of a data subject to that international organization or that recipient, unless— (a) the data subject has provided consent to the transfer of his or her personal data, upon being informed of the possible risk of the transfer; (b) the processing of the data is necessary for the performance of a contract to which the data subject is a party or, at the request of the data subject, the implementation of a pre-contractual measure; 23