Section 28(4) in The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016
(4)Without prejudice to sub-sections (1) and (2), the Authority shall-(a)adopt and implement appropriate technical and organisational security measures;(b)ensure that the agencies, consultants, advisors or other persons appointed or engaged for performing any function of the Authority under this Act, have in place appropriate technical and organisational security measures for the information; and(c)ensure that the agreements or arrangements entered into with such agencies, consultants, advisors or other persons, impose obligations equivalent to those imposed on the Authority under this Act, and require such agencies, consultants, advisors and other persons to act only on instructions from the Authority.
