What are the cases in which Personal Data can be transferred outside the State, despite Article 22 of the Decree by Law?
Personal Data can be transferred outside the State if companies in those countries do not have Data Protection laws and have a contract that obligates them to adopt measures, controls, and requirements from the Decree by Law. Additionally, the contract should also enforce the Controller or the Processor to adopt appropriate measures mandated by a judicial or regulatory authority in those countries.