DEROGATIONS AND BINDING CORPORATE RULES
As mentioned earlier, Article 26 of the Data Protection Directive contains derogations from the prohibition within Article 25 against the transfer of personal data from the EEA to a non-adequate country. The full list of derogations is contained in Article 26.1. They are:
the data subject has given his consent unambiguously to the proposed transfer; or
the transfer is necessary for the performance of a contract between the data subject and the data controller or the implementation of precontractual measures taken in response to the data subject's request;
the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller ...