A European Union (EU) law stating that personal data from EU countries can only be transferred to non-EU countries that provide an acceptable level of privacy protection. An organization must inform individuals why information about them is collected, how to contact the organization with inquiries and complaints, the types of third parties to which the organization will disclose, and the options an organization provides to limit the disclosure of certain information. Proper notice and choice must be offered to allow an individual to opt in or opt out of providing specific information the organization plans on tracking. See also Safe Harbour Agreement.