(1) Personal data may only be transferred abroad by the controller and the processor in accordance with the procedures and principles set forth in the Law and this ByLaw. In cases where personal data is transferred by the processor, the instructions from the controller shall also be complied with.

(2) The provision of the first paragraph shall also apply to onward transfers of personal data that has been transferred abroad, and transfers to international organisations.

(3) The provisions of other laws concerning the transfer of personal data abroad are reserved.