- The country in question is considered a safe third country.
- The supplier in question will begin on the model contract of the European Commission for the transfer of personal data to third countries.
- The supplier is certified according to Art. 40 of GDPR; or
- supplier in question has a set of approved binding corporate rules.