4. For purposes of this article, a “data protection impact assessment” is an assessment of the impact of the envisaged processing on the protection of personal data comprising: a) a systematic description of the envisaged processing and its purpose, including where applicable the legitimate interest justifying the processing; b) an assessment of the necessity and proportionality of the processing in relation to the purposes for which the personal data would be processed; c) an assessment of the risks to the rights and freedoms of data subjects; and d) the measures envisaged to address the risks and the safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Law. 5. The Minister may make regulations exempting categories of data controllers of major importance from some or all of the obligations under this article. 6. In determining any exemptions under sub-article 5, the Authority shall consider: a) the burden and proportionality of preparing a data protection impact assessment; b) the likelihood and gravity of risks to the rights and freedoms of data subjects; and c) other means of assessing and mitigating such risks. CHAPTER VI—CROSS-BORDER TRANSFERS OF PERSONAL DATA Article 30: Adequate level of protection for cross-border transfers of personal data 1. A data controller shall not transfer personal data to a country outside the Federal Republic of Somalia or international organisation unless one of the following conditions is met: a) the personal data shall be received solely within one or more countries, regions or specified sector within a country that affords an adequate level of protection; b) the recipient is an international organisation whose policies and administrative and technical measures afford an adequate level of protection; 22