4. Transfers out of the Abu Dhabi Global Market: adequate level of protection
(1) Except as set out in section 5, a transfer of Personal Data to a Recipient located in a jurisdiction outside the Abu Dhabi Global Market may take place only if an adequate level of protection for those Personal Data are ensured by laws applicable to the Recipient.
(2) The adequacy of the level of protection ensured by laws to which the Recipient is subject, as referred to in subsection (1), shall be assessed in the light of all the circumstances surrounding a Personal Data transfer operation or set of Personal Data transfer operations, including, but not limited to —
(a) the nature of the Personal Data;
(b) the purpose and duration of the proposed Processing operation or operations;
(c) if the data do not emanate from the Abu Dhabi Global Market, the country of origin and country of final destination of the Personal Data; and
(d) any relevant laws to which the Recipient is subject, including professional rules and security measures.
(3) The jurisdictions which the Registrar has designated as providing an adequate level of protection for Personal Data for the purposes of subsection (1) are listed in Schedule 3 to these Regulations, and may be updated from time to time by a publication to such effect on the Registrar's website.