Even if the controller does not provide adequate safeguards, e.g. in a contract, there are certain "exceptions" enabling data transfers to third countries.

One of these exceptions can be invoked when the data subjects have given their unambiguous consent to the transfer of their data to such a country, when the transfer is necessary to perform a contract with the data subject or when the data come from a public register intended to inform the public (for example telephone book, trade register). These exceptions should be interpreted restrictively and cannot constitute the normal framework for data transfers, especially massive and repeated data flows. For this type of data flows, it is therefore recommended to quickly come to a contractual solution, because in this case the recipient of the data enters into a legal commitment in order to protect the data and individuals are offered legal safeguards.