To a Member State which has transposed the SADC Model Law Transfers of personal information outside Zimbabwe o a Member state which has not transposed he SADC Model Law or to a non SADC Member State 42. 43. (1) Without prejudice to Articles 11, 12, 13 and 17, personal data shall only be transferred to recipients, (a) if the recipient establishes that the data are necessary for the performance of a task carried out in the public interest or subject to the exercise of public body, orif the recipient establishes the necessity of having the data transferred and if there is no reason to assume that the data subject's legitimate interests might be prejudiced. (b) The controller shall be required to verify the competence of the recipient and to make a provisional evaluation of the necessity for the transfer of the data. If doubts arise as to this necessity, the controller shall seek further information from the recipient. (c) The recipient shal l ensure that the necessity for the transfer of the data can be subsequently verified. (c) The recipient shall process the personal data only for the purposes for which they were transmitted (1) Subject to the provisions of this Act, a data controller or processor or any of its officers may not transfer personal information about a data subject to a third party who is in a foreign country unless : (a) Personal data shall only be transferred to recipients, other than Member States of the SADC, which are not subject to national law adopted pursuant to the SADC Model Law, if an adequate level of protection is ensured in the country of the recipient or within the recipient international organization and the data are transferred solely to allow tasks covered by the competence of the controller to be carried out. (b) The adequacy of the level of protection afforded by the third country or international organization in question shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the recipient third country or recipient international organization, the rules of law, both general and sectorial, in force in the third country or international organization in question and the professional rules and security measures which are complied with in that third country or international organization. Draft Data Protection Bill Version 1.0 54