Section 11(4)(ii) in The Credit Information Companies Regulations, 2006
(ii)Every credit information company and credit institution shall develop guidelines and procedures to be adopted by them, with the approval of the Reserve Bank, in respect of preservation and destruction of personal data.