Section 28(2)(iv) in The Credit Information Companies Rules, 2006
(iv)ensure that the best practices in relation to the deletion and disposal of data, especially where records or discs are to be disposed of off-site or by external contractors are followed;