Section 11(3) in The Credit Information Companies Regulations, 2006
(3)Solicitation of personal data from an individual .-In case of collection and use of personal data as per this regulation, by a credit institution, credit information company, or a specified user, as the case may be, they shall take such steps as are, in the circumstances, reasonable to ensure that, before such data is collected or, if that is not practicable, as soon as practicable after such data is collected-(a)the individual concerned is informed of the purpose for which such data is being collected, or disclosed, or used, as the case may be; and(b)such data maintained by them is protected against any loss, or unauthorised access, or use, or modification or disclosure, thereof.
