Article 37.- National or international data transfers may be carried out without the consent of the owner when any of the following assumptions occur:

1. When the transfer is provided for in a Law or Treaty to which Mexico is a party;
2. When the transfer is necessary for the prevention or medical diagnosis, the provision of health care, medical treatment or the management of health services;
3. When the transfer is made to holding companies, subsidiaries or affiliates under the common control of the person in charge, or to a parent company or to any company of the same group as the person in charge that operates under the same internal processes and policies;
4. When the transfer is necessary by virtue of a contract concluded or to be concluded in the interest of the owner, by the person in charge and a third party;
5. When the transfer is necessary or legally required to safeguard a public interest, or for the procurement or administration of justice;
6. When the transfer is necessary for the recognition, exercise or defense of a right in a judicial process, and
7. When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the person in charge and the owner.