Section 36(2)(b) in The Credit Information Companies (Regulation) Act, 2005
(b)the steps to be taken by every credit information company or credit institution and specified user for ensuring accuracy, completeness of data and protection of data from any loss or unauthorised access or use or disclosure under section 19;