TaxTMI 
TaxTMI 
Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011
X X X X Extracts X X X X
X X X X Extracts X X X X
....ble security practices and procedures and sensitive personal data or information) Rules, 2011. (2) They shall come into force on the date of their publication in the Official Gazette 2. Definitions - (1) In these rules, unless the context otherwise requires, -- (a) "Act" means the Information Technology Act, 2000 (21 of 2000); (b) "Biometrics" means the technologies that measure and analyse human body characteristics, such as 'fingerprints', 'eye retinas and irises', 'voice patterns', facial patterns', 'hand measurements' and 'DNA' for authentication purposes; (c) "Body corporate" means the body corporate as defined in clause (i) of explanation to section 43A of th....
X X X X Extracts X X X X
X X X X Extracts X X X X
....;- (i) password; (ii) financial information such as Bank account or credit card or debit card or other payment instrument details (iii) physical, physiological and mental health condition; (iv) sexual orientation; (v) medical records and history; (vi) Biometric information; (vii) any detail relating to the above clauses as provided to body corporate for providing service; and (viii) any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise: provided that, any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....porate or any person on its behalf shall not collect sensitive personal data or information unless - (a) the information is collected for a lawful purpose connected with a function or activity of the body corporate or any person on its behalf; and (b) the collection of the sensitive personal data or information is considered necessary for that purpose. (3) While collecting information directly from the person concerned, the body corporate or any person on its behalf shall take such steps as are, in the circumstances, reasonable to ensure that the person concerned is having the knowledge of - (a) the fact that the information is being collected; (b) the purpose for which the information is being collect....
X X X X Extracts X X X X
X X X X Extracts X X X X
....der of information shall, at any time while availing the services or otherwise; also have an option to withdraw its consent given earlier to the body corporate. Such withdrawal of the consent shall be sent in writing to the body corporate. In the case of provider of information not providing or later on withdrawing his consent, the body corporate shall have the option not to provide goods or services for which the said information was sought. (8) Body corporate or any person on its behalf shall keep the information secure as provided in rule 8. (9) Body corporate shall address any discrepancies and grievances of their provider of the information with respect to processing of information in a time bound manner. For this purpose, the bo....
X X X X Extracts X X X X
X X X X Extracts X X X X
....data or Information shall be disclosed to any third party by an order under the law for the time being in force. (3) The body corporate or any person on its behalf shall not publish the sensitive personal data or information. (4) The third party receiving the sensitive personal data or information from body corporate or any person on its behalf under sub-rule (1) shall not disclose it further. 7. Transfer of information.- A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for unde....