(1) In the absence of an adequacy decision and where the parties cannot provide one of the appropriate safeguards specified in Article 10, personal data may be transferred abroad only under one of the exceptional circumstances specified in the second paragraph, provided that such transfer is incidental. Transfers that are not regular, occur only once or a few times, do not have a continues nature, and are not part of the ordinary course of business shall be considered incidental.

(2) Exceptional cases for the transfer of personal data are as follows:

• a) The data subject has given explicit consent to the transfer, provided that he/she has been informed of the potential risks involved;
• b) The transfer is necessary for the performance of a contract between the data subject and the controller, or for the implementation of pre-contractual measures implemented at the data subject's request;
• c) The transfer is necessary for the establishment or performance of a contract between the controller and another natural or legal person, carried out in the interest of the data subject;
• ç) The transfer is necessary for a substantial public interest;
• d) The transfer of personal data is necessary for the establishment, exercise, or protection of any right;
• e) Transfer of personal data is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid;
• f) The transfer is made from a registry that is open to public or accessible to persons with legitimate interest, provided that the conditions for accessing the registry under relevant legislation are fulfilled, and that the person with a legitimate interest has requested the transfer.

(3) For transfers under subparagraph (f) of the second paragraph, the following procedures and principles shall be observed:

• a) The transfer shall not include all personal data or categories of personal data contained within the registries;
• b) Transfers from registries accessible to persons with legitimate interests shall only be made to those persons or upon their request.

(4) The provisions in subparagraphs (a), (b), and (c) of the second paragraph shall not apply to the activities of public law activities of public institutions and organisations.