Data Protection [No. 3 of 2021 123 contracts or schemes effectively protect the rights of data subjects under this Act, including in relation with further transfers from the transferees of personal data under this subsection to any other person or entity. (6) Where a data controller seeks to transfer personal data subject to a standard contract or intragroup scheme under subsection (1)(a), it shall certify and periodically report to the Data Protection Commissioner as may be specified, that the transfer is made under a contract that adheres to these standard contractual clauses or intragroup schemes and that it shall bear any liability for the harm caused due to any noncompliance with the standard contractual clauses or intragroup schemes by the transferee. PART XI GENERAL PROVISIONS 72. A data subject who has suffered damage as a result of an infringement of that data subject’s right under this Act, may receive compensation from the data controller or data processor as determined by a court of competent jurisdiction for the damage suffered. 73. (1) Subject to the other provisions of this Act, a person commits an offence if that person unlawfully discloses sensitive personal data to another person. Right to compensation Offences (2) A person convicted of an offence under subsection (1) is liable, on conviction, to a fine not exceeding two hundred thousand penalty units, or to imprisonment to a term not exceeding two years, or to both. 74. Where the Data Protection Commissioner is satisfied, after an investigation, or where a person admits that the person has committed an offence under this Act, the Data Protection Commissioner may, compound the offence by collecting from that person a sum of money that the Data Protection Commissioner considers appropriate, but not exceeding fifty percent of the maximum amount of the fine to which that person would have been liable on conviction. Power of Data Protection Commissioner to compound certain offences 75. (1) Where there has been a conviction for any of the offences under this Act, the court may pronounce the forfeiture of the medium containing the personal data to which the offence relates or make any other order as it deems fit. Forfeiture (2) A court may order forfeiture or deletion where the medium containing the personal data does not belong to the person convicted.