33 2019 Data Protection No. (2) The Data Commissioner may request a person who transfers data to another country to demonstrate the effectiveness of the security safeguards or the existence of compelling legitimate interests. (3) The Data Commissioner may, in order to protect the rights and fundamental freedoms of data subjects, prohibit, suspend or subject the transfer to such conditions as may be determined. 50. The Cabinet Secretary may prescribe, based on grounds of strategic interests of the state or protection of revenue, certain nature of processing that shall only be effected through a server or a data centre located in Kenya. Processing through a data server or data centre in Kenya. PART VII— EXEMPTIONS 51. (1) Nothing in this Part shall exempt any data controller or data processor from complying with data protection principles relating to lawful processing, minimisation of collection, data quality, and adopting security safeguards to protect personal data. General exemptions. (2) The processing of personal data is exempt from the provisions of this Act if— (a) it relates to processing of personal data by an individual in the course of a purely personal or household activity; (b) if it is necessary for national security or public interest; or (c) disclosure is required by or under any written law or by an order of the court. 52. (1) The principles of processing personal data shall not apply where— (a) processing is undertaken by a person for the publication of a literary or artistic material; (b) data controller reasonably believes that publication would be in the public interest; and (c) data controller reasonably believes that, in all the circumstances, compliance with the provision is incompatible with the special purposes. (2) Subsection (1)(b) shall only apply where it can be demonstrated that the processing is in compliance with any Journalism, literature and art. !