S22 Transfer of personal information to non-SADC Member States 33. (1) Personal information shall only be transferred to recipients, other than in Member States of SADC, or which are not subject to national law adopted pursuant to SADC data protection requirements, if an adequate level of protection is ensured in the country of the recipient and the data is transferred solely to permit processing otherwise authorised to be undertaken by the controller. (2) The adequacy of the level of protection afforded by the relevant third country in question shall be assessed in the light of all the circumstances surrounding the relevant data transfer(s), particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing, the country of the recipient, the relevant laws in force in the third country and the professional rules and security measures which are complied with in that country of the recipient. (3) The Commission shall establish the categories of processing for which and the circumstances in which the transfer of personal information to countries outside – (a) the Kingdom of Eswatini; and (b) SADC, is not authorized. (4) By way of derogation from subsection (3) above, a transfer or a set of transfers of personal information to a recipient in a country outside Eswatini or SADC which does not ensure an adequate level of protection may take place in one of the following cases (a) the data subject has unambiguously given their consent to the proposed transfer; (b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre- contractual measures taken in response to the request of the data subject; (c) the transfer is necessary for the conclusion or performance of a contract concluded or to be concluded between the controller and a third party in the interest of the data subject; (d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; (e) the transfer is necessary in order to protect the legitimate interests of the data subject; and (f) the transfer is made from a register which, according to acts or regulations, is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the case at hand. (5) Without prejudice to the provisions of the previous paragraph, the Commission may authorize a transfer or a set of transfers of personal information to a recipient country outside Eswatini or SADC which does not in its laws ensure an adequate level of protection, if the