Section 28(1) in The Credit Information Companies Rules, 2006
(1)Every credit institution, credit information company, and specified user, existing before the commencement of these rules within three months of such commencement and every credit institution, credit information company or specified user coming into existence after the commencement of these rules within three months of commencement of their business, shall take such steps as they may deem necessary to ensure that the data, information and the credit information maintained by them is duly protected against any unauthorised access or use and formulate and adopt an appropriate policy and procedure in this behalf with the approval of their Board of Directors.
