1. Notwithstanding Article (22) of this Decree by Law, Personal Data may be transferred to outside the State in the following cases: a. Companies, operating in countries where there are no laws for Data Protection, may transfer data under a contract or agreement obligating the companies in such countries to adopt measures, controls and requirements set out in this Decree by Law, in addition to provisions forcing the Controller or the Processor to adopt appropriate measures which are imposed by a judicial or regulatory authority in such countries as set out in the contract. b. If there is an explicit consent granted by the Data Subject to transfer his/her Personal Data outside the State, provided that such transfer shall not contradict the public or security interest of the State. c. If the transfer is necessary to fulfil obligations and establish rights before judicial entities, exercise or defend the same. d. If the transfer is necessary to sign or implement a contract made between the Controller and the Data Subject, or between the Controller and third parties to serve the interest of the Data Subject. e. If the transfer is necessary to implement an action related to an international judicial cooperation. f. If the transfer is necessary to protect the public interest. 2. The Executive Regulations of this Decree by Law set forth the controls and stipulations referred to in Paragraphs (1) of this Article, which should be observed during the transfer of data outside the State.
Interpretation and application must be checked against the official text and current version.