Personal Data Protection Act, No. 9 of 2022 21 shall adopt such instruments as may be specified by the Authority to ensure binding and enforceable commitments of the recipient in the third country to ensure appropriate safeguards to the rights of the data subjects and remedies protected by this Act. (5) In the absence of any adequacy decision pursuant to subsection (2) or appropriate safeguards pursuant to subsecion (4), a controller or processor other than a public authority may process personal data outside Sri Lanka if– (a) the data subject has explicitly consented to the proposed processing of personal data outside Sri Lanka, after having been informed of the possible risks of such processing for the data subject due to the absence of an adequacy decision and appropriate safeguards; or (b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre contractual measures taken by the controller at the request of the data subject; or (c) the transfer is necessary for the establishment, exercise or defence of legal claims relating to the data subject; or (d) the transfer is necessary for reasons of public interest as defined in item (g) of Schedule I of this Act; or (e) the transfer is necessary to respond to an emergency that threatens the life, health, or safety of the data subject or another person and where the data subject or his legal guardian is physically or legally incapable of giving consent; or (f) such processing is permitted under any other conditions as may be prescribed under this Act.