Under GDPR, the European Commission takes the adequacy decision in relation to privacy laws in a third
country, territory, sector etc. A subjective approach is taken. For the assessment of whether a third country, a
territory, or one or more specific sectors within that third country, or an international organization has an
adequate level of protection, who is required to provide an opinion to the Commission?
Under which of the following conditions can a company in India may transfer sensitive personal information
(SPI) to any other company or a person in India, or located in any other country?