Personal data can only be processed in accordance with the purpose specification. Incorrect. This is one of the legal limitations.
Personal data cannot be reused without explicit and informed consent. Incorrect. This is one of the legal limitations.
Personal data may only be processed when there are no other means to achieve the purposes. Correct. This is the definition of subsidiarity. (Literature: A, Chapter 3; GDPR Article 35(7)) Personal data must be adequate, relevant and not excessive in relation to the purposes. Incorrect. This is the definition of proportionality.

Transfers based on the laws of the non-EEA country concerned. Incorrect. This would also require an adequacy decision confirming that those laws are sufficient.
Transfers falling under World Trade Organization rules. Incorrect. WTO only covers free trade of goods and services.
Transfers governed by approved binding corporate rules (BCR). Correct. Binding corporate rules approved by a supervisory authority involved make the transfer lawful. (Literature: A, Chapter 7; GDPR Article 47) Transfers within a global corporation or organization. Incorrect. This would also require that they adopt official binding corporate rules.
Reference:
https://edps.europa.eu/data-protection/data-protection/reference-library/international-transfers_en

An offense to privacy, as any illegal processing of personal data is considered an offense.

Anonymized data is not under the scope of the GDPR, nor are data from deceased persons. Organizations that handle only this type of data do not need to conform to the GDPR.
Anonymized data reads data that is not possible to reverse in order to identify the data subject. There is also pseudonymized data, in which case it is possible to perform the reversal and identify the data holder.