Section 27(1) in The Credit Information Companies Rules, 2006
(1)Every specified user, in existence on the commencement of these rules within three months of such commencement, and every specified user, coming into existence after the commencement of these rules within three months of its becoming member of a credit information company, shall take such requisite steps as it may deem necessary for ensuring and verifying the accuracy and completeness of data, information or credit information received from a credit information company before using the same in relation to a borrower, or a client, in relation to their operations and to ensure protection thereof from unauthorised access, or use and formulate and adopt an appropriate policy and procedure in this behalf with the approval of their Board of Directors.
