Section 11 in The Credit Information Companies Regulations, 2006
11. Principles and procedures relating to personal data - (1) Every credit institution, credit information company and specified user, as the case may be, shall adopt the following principles and procedures in respect of:
(a)the manner and purpose of collection of personal data;(b)solicitation of personal data from individual concerned;(c)their extent of accountability; and(d)for redressal of grievances of individuals in respect of personal data.(2)Manner and purpose of collection of personal data .-No credit institution or credit information company, or specified user, as the case may be, shall collect, or publish or disclose, personal data except for the purposes relating to their functions:(a)as per the provisions of the Act, or their activities incidental or relating to their such functions; or(b)in relation to their capacity and function as an employer of an individual who is or has been in their employment.(3)Solicitation of personal data from an individual .-In case of collection and use of personal data as per this regulation, by a credit institution, credit information company, or a specified user, as the case may be, they shall take such steps as are, in the circumstances, reasonable to ensure that, before such data is collected or, if that is not practicable, as soon as practicable after such data is collected-(a)the individual concerned is informed of the purpose for which such data is being collected, or disclosed, or used, as the case may be; and(b)such data maintained by them is protected against any loss, or unauthorised access, or use, or modification or disclosure, thereof.(4)Length of preservation of personal data .-(i) Every credit information company and credit institution shall retain personal data collected, maintained and disseminated by them for a minimum period of seven years.(ii)Every credit information company and credit institution shall develop guidelines and procedures to be adopted by them, with the approval of the Reserve Bank, in respect of preservation and destruction of personal data.Explanation .-For the purpose of this regulation, "personal data" means such other data relating to an individual other than what a credit institution, or a credit information company, or a specified user, is permitted to collect as per the provisions of the rules made under the Act.
