According to Article 19 to 21 of the Personal Data Protection Act, if the destination to which the data is to be transferred is not verified by the Bureau as having adequate protection for personal data, even if the transfer has been agreed by the data subjects, the data controller is still required to notify the PDPB, despite it does not have to seek authorization. In terms of combination of personal data, according to Article 9 and 22 of the Act, unless it is provided for in law or public department's organic law, the processing entity or other entity sharing the responsibility of the processing must seek the authorization of the PDPB.