20 Personal Data Protection Act, No. 9 of 2022 personal data which may be permitted to be processed in a third country, prescribed by the Minister pursuant to an adequacy decision made under subsection (2). (2) (a) For the purpose of making an “adequacy decision”, the Minister shall, in consultation with the Authority take into consideration the relevant written law and enforcement mechanisms relating to the protection of personal data in a third country and the application of the provisions of Part I, Part II and sections 20, 21, 22, 23, 24 and 25 of Part III of this Act, and such other prescribed criteria relating to the processing of personal data, in a third country for the purpose of cross border data flow. (b) Any adequacy decision made by the Minister under this subsection shall– (i) be subject to periodic monitoring of the developments in a third country that may affect such decisions and the Minister may review such decision at least every two years; and (ii) remain in force until amended or revoked by the Minister in consultation with the authority. (3) A controller or processor other than a public authority may process personal data– (a) in a third country prescribed pursuant to an adequacy decision; or (b) in a country, not being a third country prescribed pursuant to an adequacy decision, only where such controller or processor as the case may be, ensures compliance with the respective obligations imposed under Part I, Part II and sections 20, 21, 22, 23, 24 and 25 of Part III of this Act. (4) For the purpose of ensuring compliance under paragraph (b) of subsection (3), a controller or processor