41. (2) The Central Government shall notify categories of personal data as critical personal data that shall only be processed in a server or data centre located in India. (3) Notwithstanding anything contained in sub-section (1), the Central Government may notify certain categories of personal data as exempt from the requirement under subsection (1) on the grounds of necessity or strategic interests of the State. (4) Nothing contained in sub-section (3) shall apply to sensitive personal data. Conditions for Cross-Border Transfer of Personal Data. — (1) Personal data other than those categories of sensitive personal data notified under subsection (2) of section 40 may be transferred outside the territory of Indiawhere— (a) (b) (c) (d) (e) the transfer is made subject to standard contractual clauses or intra-group schemes that have been approved by the Authority; or the Central Government, after consultation with the Authority, has prescribed that transfers to a particular country, or to a sector within a country or to a particular international organisation is permissible; or the Authority approves a particular transfer or set of transfers as permissible due to a situation of necessity; or in addition to clause (a) or (b) being satisfied, the data principal has consented to such transfer of personal data; or in addition to clause (a) or (b) being satisfied, the data principal has explicitly consented to such transfer of sensitive personal data, which does not include the categories of sensitive personal data notified under sub-section (2) of section 40. (2) The Central Government may only prescribe the permissibility of transfers under clause (b) of sub-section (1) where it finds that the relevant personal data shall be subject to an adequate level of protection, having regard to the applicable laws and international agreements, and the effectiveness of the enforcement by authorities with appropriate jurisdiction, and shall monitor the circumstances applicable to such data in order to review decisions made under this sub-section. (3) Notwithstanding sub-section (2) of Section 40,sensitive personal data notified by the Central Government may betransferred outside the territory of India— (a) (b) to a particular person or entity engaged in the provision of health services or emergency services where such transfer is strictly necessary for prompt action under section 16; and to a particular country, a prescribed sector within a country or to a particular international organisation that has beenprescribed under clause (b) of sub-section (1), wherethe Central Government is satisfied that such transfer or class of 24