Section 29(2) in The Credit Information Companies Rules, 2006
(2)Every credit information company or credit institution or specified user, existing before the commencement of these rules shall within three months of such commencement of these rules and every credit institution or credit information company or specified user within three months of commencement of their business after coming into force of the rules shall, formulate the policy and procedure duly approved by its Board of Directors specifying therein the steps to be taken by them to ensure compliance of the fidelity and secrecy obligation by their managers, officers, employees with respect to data, information and credit information under their control.
