transfersis necessary for any class of data fiduciaries or data principals anddoesnot hamper the effective enforcement of this Act. (4) Any transfer under clause (a) ofsub-section (3) shall be notified to the Authority within such time period as may be prescribed. (5) The Authority may only approve standard contractual clauses or intra-group schemes under clause (a) of sub-section (1) where such clauses or schemes effectively protect the rights of data principals under this Act, including in relation with further transfers from the transferees of personal data under this sub-section to any other person or entity. (6) Where a data fiduciary seeks to transfer personal data subject to standard contractual clauses or intra-group schemes under clause (a) of sub-section (1), it shall certify and periodically report to the Authority as may be specified, that the transfer is made under a contract that adheres to such standard contractual clauses or intra-group schemes and that it shall bear any liability for the harm caused due to any non-compliance with the standard contractual clauses or intra-group schemes by the transferee. CHAPTER IX EXEMPTIONS 42. Security of the State.— (1) Processing of personal data in the interests of the security of the State shall not be permitted unless it is authorised pursuant to a law,andis in accordance with the procedure established by such law, made by Parliament and is necessary for, and proportionate to, such interests being achieved. (2) Any processing authorised by a lawreferred to in sub-section (1) shall be exempted from the following provisions of the Act— (a) (b) (c) (d) (e) (f) (g) 43. Chapter II, except section 4; Chapter III; Chapter IV; Chapter V; Chapter VI; Chapter VII, except section 31; and Chapter VIII. Prevention, detection, investigation and prosecution of contraventions of law.— (1) Processing of personal data in the interests of prevention, detection,investigation and prosecution of any offence or any other contravention of law shall not be permitted unless 25