Section 24(1) in The Credit Information Companies Rules, 2006
(1)Every credit information company, in existence on the commencement of these rules within three months of the commencement of these rules, and every credit information company to whom a certificate of registration has been granted, after the commencement of these rules within three months of such grant, shall take such requisite steps, as it may deem necessary, in relation to their operations and accordingly formulate policy and procedure duly approved by their Board of Directors and adopt the same with respect to the following operations, namely:-(a)collection, processing and collating of data, information and credit information relating to their borrower, or client, obtained and received by them from a member credit institution or credit information company, as the case may be;(b)steps to be taken for ensuring security and protection of such data, information and the credit information maintained by them;(c)appropriate and necessary steps for maintaining an accurate, complete and updated data, information and credit information, in respect of their borrower, or client, and to ensure the accuracy and completeness thereof while furnishing the same to a specified user or making disclosure thereof to anyone else, in accordance with the provisions of the Act; and(d)transmitting data, information and credit information through secured medium.
