SADC data protection requirements and the data is transferred solely to permit processing otherwise authorised to be undertaken by the controller. or (2)The adequacy of the level of protection afforded by the relevant to a non-Member third country in question shall be assessed in the light of all the State circumstances surrounding the relevant data transfer(s), particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing, the recipient’s country, the relevant laws in force in the third country and the professional rules and security measures which are complied with in that recipient’s country. (3)The Commission shall establish the categories of processing for which and the circumstances in which the transfer of personal information to countries outside (i) Lesotho and (ii) SADC is not authorized. (4)By way of derogation from (3) above, a transfer or a set of transfers of personal information to a recipient in a country outside Lesotho or SADC which does not ensure an adequate level of protection may take place in one of the following cases: (a) the data subject has unambiguously given his/her consent to the proposed transfer; (b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject's request; (c) the transfer is necessary for the conclusion or performance of a contract concluded or to be concluded between the