Section 5(2) in The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
(2)Body corporate or any person on its behalf shall not collect sensitive personal data or information unless -(a)the information is collected for a lawful purpose connected with a function or activity of the body corporate or any person on its behalf; and(b)the collection of the sensitive personal data or information is considered necessary for that purpose.
