Absent an adequacy decision or appropriate safeguards, transfers to a third country or an international organisation are permitted only where one of seven conditions applies: explicit informed consent after warning of risks; necessity for performance of a contract with the data subject or pre‑contractual measures at their request; necessity for a contract concluded in the data subject’s interest between the controller and another person; necessity for important public interest; necessity for establishment, exercise or defence of legal claims; necessity to protect vital interests where the data subject cannot consent; or transfer from a public register intended for consultation, subject to the register’s legal consultation conditions.

If none of those conditions apply, a transfer may occur only if non‑repetitive, concerns a limited number of data subjects, is necessary for compelling legitimate interests of the controller not overridden by the data subject’s rights, and suitable safeguards are provided after assessment; the controller must inform the supervisory authority and the data subject and record the assessment and safeguards in the Article 30 records. Point (g) must not involve entire registers or categories; points (a)–(c) do not apply to public authorities exercising public powers; the public interest in (d) must be recognised in Union or Member State law; Member States may set and must notify limits on transfers of specific categories.