Personal Data Protection Act GN. NO. 395B (Contd) protection transferred solely to permit processing authorised to be undertaken by the controller. (2) The adequacy of the level of protection afforded by the relevant third country shall be assessed in the light of(a) all the circumstances surrounding the relevant personal data transfer; (b) nature of the personal data; (c) the purpose and duration of the proposed processing; (d) the recipient’s country; (e) the relevant laws in force in the third country; and (f) the professional rules and security measures which are complied within that recipient’s country. (3) The Minister shall, after consultation with Commission and by regulations, specify categories of processing for which and the circumstances in which the transfer of personal data to countries outside the United Republic is not authorised. (4) Notwithstanding the provisions of subsection (3), a transfer of personal data to a recipient in a country outside the country or to a country which does not have adequate level of protection may take place in one of the following cases(a) the data subject has consented to the proposed transfer; (b) the transfer is necessary for the performance of a contract between the data subject and the data controller or the implementation of precontractual measures taken in response to the data subject’s request; (c) the transfer is necessary for the conclusion or performance of a contract concluded or to be concluded between the data controller and a third party in the interest of the data subject; (d) the transfer is necessary or legally required 21