c) the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct, certification mechanism or other measure that affords an adequate level of protection; or d) one of the legal bases set forth in article 31 applies. 2. The adequacy of level of protection under sub-article 1 shall be assessed taking into account: a) whether the form of protection upholds principles that are substantially similar to the conditions for processing of the personal data provided for in this Law, including in relation to the onward transfer of personal data to outside of the recipient’s jurisdiction; b) the availability of enforceable data subject rights, the ability of data subjects to enforce their rights through administrative or judicial redress, and the rule of law generally; c) the existence and terms of any legally binding instrument between the Authority and a relevant public authority in the recipient country relating to data protection; d) the access of a foreign public authority to personal data; e) the existence of an effective data protection law in the jurisdiction where the recipient will receive the personal data; f) the existence and functioning of an independent, competent data protection or similar supervisory authority with adequate enforcement powers in the jurisdiction where the recipient will receive the personal data; and g) international commitments and conventions binding on the jurisdiction where the recipient will receive the personal data and its membership in any multilateral or regional organisations. 3. A data controller shall keep a record of the condition under sub-article 1 relied upon to permit a transfer of personal data to a country outside the Federal Republic of Somalia or an international organisation, including any assessment made under sub-article 2. 4. The Authority may: a) issue rules and guidelines with respect to the assessment of adequacy of protection under sub-article 1 and the factors under sub-article 2; b) designate any international organisation, country, region or specified sector within a country, law, binding corporate rules, contractual clauses, code of conduct, certification mechanism or other measure as affording or not affording adequate protection under sub-article 1; 23