Under the Data Protection Regulation, the Act of 2018 and subsections (2) and (4), the Authority may enter into arrangements with a person outside the State to furnish information required by that person for performance of their functions, and to receive information from that person required by the Authority for performance of its functions under the Act. Such exchanges are limited to information necessary for those functions and concern persons performing the same or similar functions as the Authority.

The Authority shall not furnish information to a person outside the State unless it obtains a written undertaking that the person will not use or disclose the information except for functions the same as or similar to the Authority’s and will comply with any other conditions specified by the Authority. The Authority may give reciprocal undertakings when required by the other party, and arrangements must not require disclosure prohibited by law. "Person outside the State" is defined by reference to foreign law performing equivalent functions.