285 formance of a conttact, and (i) (ii) the request of the data subject in terms of the contract has been met; or appropriate measures have been taken to pr.otect the data subject,s legitimate intelests such as re_ quiring a controller to provide a datasubject _!a.ta with sufficient information about the decision to enable him to make r.epresentations and al_ lowing for a data subject to make repr.esentations about a decision refened to in subsection (1); or (b) is governed by a 1aw or code in which appropriate meas_ ures are specified for protecting the legitimaie interests of data subjects. Thansfer of personal information outside Lesotho 52' Adatacontroller in Lesotho shall not transfer personal information about a data subject to a third party who is in a for.eign unl"rs _ "ourtry (a) the lecipient of the information is subject to a law, code of conduct (i) (ii) or. contract which _ effectively uphoids principles for reasonable processing of the information that are substan_ tially similar to the information pr.otection prin_ ciples under this Act; and includes provisions, that are substantialry similar to this section, relating to the further transfer of personal information from the recipient to third parties who are in a foreign country; (b) the data subject consents to the transfer; (c) the transfer is necessary for the performance of a con_ tract between the data subject and the clata controller, or for the implementation of pre-conttactual measur.es