45. (1) Personal data may be transferred to another country or territory on the basis of necessity is such a transfer is necessary for any of the purpose outlined under section 48 (c) of the Act.

(2) Prior to making a transfer under sub-regulation (1), a transferring entity shall ascertain that—

(a)  that the transfer is strictly necessary in a specific case outlined under section 48(c) of the Act;

(b)  there are no fundamental rights and freedoms of the data subject concerned that override the public interest necessitating the transfer.

(3) This section does not affect the operation of any international agreement in force between Kenya and other countries in the field of judicial co-operation in criminal matters and police co-operation.