Data Protection No. 24 of 2019 [Subsidiary] 44. Transfers on the basis of an adequacy decision (1) A transfer of personal data to another country or a relevant international organization is based on an adequacy decision where the Data Commissioner makes a decision that— (a) the other country or a territory or one or more specified sectors within that other country, or (b) the international organization, ensures an adequate level of protection of personal data. (2) The Data Commissioner may publish on its website a list of the countries, territories and specified sectors within that other country and relevant international organisation for which the Data Commissioner has made a decision that an adequate level of protection is ensured. 45. Transfers on the basis of necessity (1) Personal data may be transferred to another country or territory on the basis of necessity is such a transfer is necessary for any of the purpose outlined under section 48 (c) of the Act. (2) Prior to making a transfer under sub-regulation (1), a transferring entity shall ascertain that— (a) that the transfer is strictly necessary in a specific case outlined under section 48(c) of the Act; (b) there are no fundamental rights and freedoms of the data subject concerned that override the public interest necessitating the transfer. (3) This section does not affect the operation of any international agreement in force between Kenya and other countries in the field of judicial co-operation in criminal matters and police co-operation. 46. Transfer on basis of consent. (1) In accordance with section 25 (g) of the Act, in the absence of an adequacy decision, appropriate safeguards or prerequisites for transfer as a necessity, a transfer or a set of transfers of personal data to another country shall take place only on the condition that the data subject— (a) has explicitly consented to the proposed transfer; and (b) has been informed of the possible risks of such transfers. (2) Without limiting the generality of sub-regulation (1), a data controller or processor must seek consent from a data subject for the transfer of sensitive personal data, in accordance with section 49 of the Act. 47. Subsequent transfers. (1) Where personal data is transferred in accordance with this Part, the entity effecting the transfer shall make it a condition of the transfer, that the data is not to be further transferred to another country or territory without the authorisation of the transferring entity or another competent authority. (2) A competent authority may give an authorisation under sub-regulation (1) only where the further transfer is necessary for a law enforcement purpose. 48. Provisions for the agreement to cross boarder transfer A transferring entity may enter into a written agreement with the recipient of personal data, which shall contain provisions relating to— (a) unlimited access by the transferring entity to ascertain the existence of a robust information system of the recipient for storing the personal data; and (b) the countries and territories to which the personal data may be transferred under the contract. 35