(1) Subject to subsection (2), a data controller shall not transfer personal data to a country or territory outside Saint Lucia unless —
(a) the country or territory to which the personal data is being transferred has comparable safeguards to those in Saint Lucia for the protection of the rights and freedom of the data subject in relation to the processing of personal data; and
(b) the Commissioner has authorized the data controller to transfer the personal data to the country or territory outside Saint Lucia.
(2) Subsection (1)(a) does not apply if —
(a) the data subject has given his or her consent to the transfer;
(b) the transfer is necessary —
(i) for the performance of a contract between the data subject and the data controller, or for the taking of steps at the request of the data subject with a view to entering into a contract with the data controller,
(ii) for the conclusion of a contract between the data controller and a person, other than the data subject, which is entered at the request of the data subject, or is in the interest of the data subject for the performance of such a contract, or
(iii) to safeguard national security or where section 56 applies;
(c) the matter concerns public security; or
(d) the transfer is made on such terms as may be approved by the Commissioner as ensuring the adequate safeguards for the protection of the rights of the data subject.