Non-EU judicial and administrative access: The amendments include a requirement that the data controller seek approval of the relevant data protection authority before disclosing data in response to a court or other legal order issued by a third country.