SADC
data
protection
requirements
and the data is transferred solely to permit processing otherwise
authorised to be undertaken by the controller.
or
(2)The adequacy of the level of protection afforded by the relevant
to a non-Member
third country in question shall be assessed in the light of all the
State
circumstances surrounding the relevant data transfer(s), particular
consideration shall be given to the nature of the data, the purpose and
duration of the proposed processing, the recipient’s country, the
relevant laws in force in the third country and the professional rules
and security measures which are complied with in that recipient’s
country.
(3)The Commission shall establish the categories of processing for
which and the circumstances in which the transfer of personal
information to countries outside (i) Lesotho and (ii) SADC is not
authorized.
(4)By way of derogation from (3) above, a transfer or a set of transfers
of personal information to a recipient in a country outside Lesotho or
SADC which does not ensure an adequate level of protection may take
place in one of the following cases:
(a) the data subject has unambiguously given his/her consent
to the proposed transfer;
(b) the transfer is necessary for the performance of a contract
between the data subject and the controller or the
implementation of precontractual measures taken in
response to the data subject's request;
(c) the transfer is necessary for the conclusion or performance
of a contract concluded or to be concluded between the