The restrictions imposed by Article 25 of the Data Protection Directive (95/46/EC) on organisations transferring personal data out of the European Economic Area aren’t new. Indeed, few, if any, data protection issues have attracted as much attention as those presented by Article 25. Its provisions needn’t be set out again here; suffice to say, nearly ten years after its restrictions first appeared, transferring personal data out of the EEA is not a straightforward matter; far from it.