(1)A transfer of personal data to a third country or an international organisation is based on there being appropriate safeguards where—
(a)a legal instrument containing appropriate safeguards for the protection of personal data binds the intended recipient of the data, or
(b)the controller, having assessed all the circumstances surrounding transfers of that type of personal data to the third country or international organisation, concludes that appropriate safeguards exist to protect the data.
(2)The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1)(b).
(3)Where a transfer of data takes place in reliance on subsection (1)—
(a)the transfer must be documented,
(b)the documentation must be provided to the Commissioner on request, and
(c)the documentation must include, in particular—
(i)the date and time of the transfer,
(ii)the name of and any other pertinent information about the recipient,
(iii)the justification for the transfer, and
(iv)a description of the personal data transferred.