TaxTMI 
TaxTMI 
Data Protection and Processing of Personal Information
X X X X Extracts X X X X
X X X X Extracts X X X X
....to the receiving customs authority in accordance with Annexure-D; (d)"personal data breach" means a breach of data security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, the personal data transmitted, stored or otherwise processed; (e)"process", "processed" or "processing" means any operation or set of operations which are performed on personal data or on sets of personal data, whether by wholly or partially automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (f) "professional secrecy" means the laws and regulations applicable to a customs authority obliging it not to disclose non-public information received in an official capacity; (g)"receiving customs authority" means the customs authority in India receiving the requested information pursuant to the Agreement; (h)"receiving Party" means India; (i) "transferring customs authority"....
X X X X Extracts X X X X
X X X X Extracts X X X X
....toms authority shall ensure that, to the best of its knowledge, the personal data it transfers is accurate and up to date. (2) If a customs authority becomes aware that the personal data it has transferred or received is inaccurate or has become outdated, it shall inform the other customs authority without undue delay. Each customs authority shall take reasonable steps to ensure that inaccurate personal data is erased, corrected or otherwise rectified as appropriate and in a timely manner, having regard to the purpose of processing. 5. Storage Limitation .- The receiving customs authority shall retain the personal data no longer than necessary and appropriate for the purpose for which it is processed, including any administrative, quasi-judicial or judicial proceedings initiated for the failure to comply with laws and regulations implementing these rules. The receiving customs authority shall put in place appropriate technical or organisational measures to ensure compliance with this obligation. 6. Scrutiny of Processing .- (1) The transferring customs authority during the transmission of the personal data and the receiving customs authority upon receipt of the personal da....
X X X X Extracts X X X X
X X X X Extracts X X X X
....contained in paragraph 11; (e) the information on any onward transfer in paragraph 13; and (f) the information on the right to lodge a complaint with the customs authority. (3) The transferring customs authority shall, at the request of the receiving customs authority, cooperate with the receiving customs authority in responding to enquiries and requests from data subjects under sub-paragraphs (1) and (2). (4) Each customs authority shall provide that the information specified in sub-paragraph (2) is provided free of charge within the time limits specified in paragraph 12. (5) In case where the provision of such information is denied or restricted, the customs authority shall inform the data subject in writing without undue delay, setting out the basis for the denial or restriction. (6) Each customs authority may publish guidance relating to the operation of this paragraph. 8. Rectification .- (1) Each customs authority shall ensure that data subjects are able to seek the correction or rectification of their personal data if they assert that it is inaccurate, no longer necessary for the purposes for which it was collected or processed or has not bee....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ions. (2) Each Party may restrict disclosure to prevent prejudice or harm to supervisory or enforcement functions of an authority of the Party acting in the exercise of the official authority vested in it. (3) Each Party shall provide that provisions restricting disclosure shall only be relied on, if necessary, provided by law and in accordance with this Annexure. Each Party shall provide that reliance continues only for as long as the reason for the restriction on disclosure exists. (4) The receiving customs authority shall ensure that the relevant data subject is informed in writing about the restriction applied, without undue delay, unless doing so would prejudice the reasons for the restriction. 11. Transparency .- (1) Each Party shall make a transparency notice available to data subjects, describing in a clear and accessible manner as to how personal data under this Annexure may be processed by its customs authority in its capacity as a transferring or receiving authority. (2) The transparency notice shall provide information on the purposes of processing, rights available to data subjects and procedures to exercise them, relevant safeguards and any limitations ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....tions or any of the requirements specified in this Annexure. (3) Each Party shall provide that the reviewer may, where considered appropriate, inform the relevant data subject about the progress of their complaint. The reviewer shall formally respond to the complaint within thirty days of its receipt, or in exceptional cases, within forty- five days. (4) Each Party shall provide that a formal written response setting out its determination and any recommendations relating to the matters raised includes details of the complaint escalation process, including judicial redress pursuant to paragraph 15, that the relevant data subject may pursue if they are not satisfied with the outcome of the handling by the reviewer. 15. Judicial Redress .- (1) Each Party shall ensure that if a data subject believes that that Party has failed to comply with the obligations specified in paragraphs 7, 8 or 14, or believes that their personal data has been subject to a personal data breach, that data subject can seek judicial redress against that Party following that Party's domestic appeal and dispute resolution process as part of the data protection laws and regulations, as appropriate. ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....egrity of the system or the personal data, the transferring Party may suspend transfers of personal data with immediate effect, taking into account the nature of the breach and risks to individuals. A suspension shall not be initiated in response to isolated or minor breaches, particularly where the receiving Party has taken prompt and appropriate remedial action to contain the breach and prevent its recurrence. (6) The receiving customs authority shall continue to accept origin declarations as applicable proofs of origin in accordance with rule 16 in the event that data transfers to enable the authentication process pursuant to sub-rules (6) and (7) of rule 17 and Annexure-D are suspended under this paragraph. (7) Where a personal data breach occurs prior to the receipt by the receiving Party, including during transmission of personal data by the transferring Party, the transferring Party may suspend the transfer of personal data in accordance with sub-paragraph 5. The Parties shall enter into consultations without delay to ensure that appropriate remedial measures are taken by the transferring Party to prevent recurrence. Where continued authentication of origin declaration....